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Abstract 

Motivated by a connection, described here for the first time, between the hidden 
normal subgroup problem (HNSP) and abelian hypergroups (algebraic objects that 
model collisions of physical particles), we develop a stabilizer formalism using abelian 
hypergroups and an associated classical simulation theorem (a la Gottesman-Knill). 
Using these tools, we develop the first provably efficient quantum algorithm for finding 
hidden subhypergroups of nilpotent abelian hypergroups and, via the aforementioned 
connection, a new, hypergroup-based algorithm for the HNSP on nilpotent groups. 
We also give efficient methods for manipulating non-unitary, non-monomial stabilizers 
and an adaptive Fourier sampling technique of general interest. 


1 Introduction 

Background and motivation 

Ever since Shor’s groundbreaking discovery of an efficient quantum algorithm for factoring 
[1], researchers have strived to understand the source of its quantum speed up and hnd 
new applications for quantum computers. An era of breakthroughs followed, in which 
researchers found that factoring and discrete log are instances of the so-called Hidden 
Subgroup Problem (HSP), a more general problem about finite groups] developed efficient 
quantum algorithms for the abelian group HSP [2-9]; and discovered that solving the 
nonabelian group HSP over symmetric and dihedral groups would lead to a revolutionary 
algorithm for Graph Isomorphism [10] and break lattice-based cryptography [11]. 

Motivated by these breakthroughs, there has been a great deal of research work over the 
last decade aimed at finding efficient quantum algorithms for nonabelian HSPs, leading to 
many successes [12-33], though efficient quantum algorithms for dihedral and symmetric 
HSP have still not been found. 

Thus far, the foundation of nearly all known quantum algorithms for nonabelian HSPs 
has been the seminal work of Hallgren, Russell, and Ta-Shma [12], which showed that 
hidden normal subgroups can be found efficiently for any nonabelian group. For example, 
the algorithms for (near) Hamiltonian groups [34] work because all subgroups of such 
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groups are (nearly) normal. Likewise, the sophisticated algorithm of Ivanyos et al. for 2- 
nilpotent groups [35] cleverly reduces the problem of finding a hidden non-normal subgroup 
to two problems of finding hidden normal subgroups. 

Surprisingly, given the importance of the nonabelian HSP program in the history of 
quantum computing, the success of the quantum algorithm for the hidden normal subgroup 
problem (HNSP) [12] remains poorly explained. The initial motivation for this work was 
improve our understanding of the quantum algorithm for the HNSP up to the same level 
as those for abelian HSPs. 

Our approach was inspired by a (fairly unexpected) recently discovered connection by 
Bermejo-Vega-Lin-Van den Nest [36], between Shor’s algorithm and two other foundational 
results in quantum computation, namely, Gottesman’s Pauli stabilizer formalism (PSF) 
[37], widely used in quantum error correction, and the Gottesman-Knill theorem [37-39], 
which proves the efficient classical simulability of Glifford circuits. In short, the BVLVdN 
connection states that the quantum algorithms for abelian HSPs belong to a common 
family of highly structured quantum circuits built of normalizer gates over abelian groups 
[40-42] (quantum Fourier transforms, group automorphism gates, and quadratic phase 
gates). This fact, combined with the generalized Group Stabilizer Formalism (GSF) for 
simulating normalizer circuits [40-42] , was used to prove a sharp no-go theorem for finding 
new quantum algorithms with the standard abelian group Fourier sampling techniques. 

Given the success of [36] at understanding abelian HSP quantum algorithms using an 
abelian group stabilizer formalism, our aim in this work is to gain a deeper understanding 
of the algorithm for HNSPs on nonabelian groups using a more sophisticated stabilizer 
formalism. Furthermore, because the PSF (and generalizations) have seminal applications 
in fault tolerance [39, 43], measurement based quantum computation [44], and condensed 
matter theory [45], we expect a new stabilizer formalism to find new uses outside of 
quantum algorithm analysis. 

Main results 

While it would be natural to generalize the abelian group stabilizer formalisms into a 
nonabelian group stabilizer formalism, we find that the proper way to understand the 
quantum algorithm for the HNSP is not to generalize the “abelian” property but rather 
the “group” property. In particular, we will work with abelian hypergroups. These are gen¬ 
eralizations of groups and can be thought of as collections of particles (and anti-particles) 
with a “collision” operation that creates new particles. A group is a special case of a 
hypergroup where each collision produces exactly one resulting particle. 

Our first result is a formal connection between the HNSP and abelian hypergroups 
which will be helpful to understand why quantum computers can solve this problem: 

I. Connecting the HNSP to the abelian HSHP. We demonstrate (section 3) 

that, in many natural cases, the HNSP can be reduced to a problem on abelian 
hypergroups, called the hidden subhypergroup problem (HSHP) [46, 47]. This occurs 
because all of the information about the normal subgroups of a nonabelian group 
is captured in its hypergroup of conjugacy classes. Even in a nonabelian group, 
there is a multiplication operation on conjugacy classes that remains abelian. Our 
results show that, in many natural cases, finding hidden normal subgroups remains 
a problem about an abelian algebraic structure even when the group is nonabelian. 

Our next results show that the tools that proved successful for understanding quantum 
algorithms for abelian group HSPs (as well as many other problems) can be generalized 
to the setting of abelian hypergroups: 
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II. A hypergroup stabilizer formalism. We extend the PSF [37-39], a powerful 
tool for describing quantum many-body states as eigenstates of commuting groups 
of Pauli operators, and the GSF, the abelian group extension of [40, 41], to a stabilizer 
formalism using commuting hypergroups of generalized Pauli operators. The latter 
are no longer unitary nor monomial but still exhibit rich Pauli-like features that let us 
manipulate them with (new) hypergroup techniques and are normalized by associated 
Clifford-like gates. We also provide a normal form for hypergroup stabilizer states 
(theorem 4) that are CSS-like [48-50] in our setting. 

III. A hypergroup Gottesman-Knill theorem. We introduce models of normalizer 
circuits over abelian hypergroups, which contain hypergroup quantum Fourier trans¬ 
forms (QFTs) and other entangling gates. Our models extend the known families 
of Clifford circuits [37-39] and (finite) abelian group normalizer circuits [40, 41, 36]. 
We show (theorem 3) that the dynamical evolution of such circuits can be tracked 
in our hypergroup stabilizer picture and, furthermore, that for large hypergroup 
families (including products of constant size hypergroups), many hypergroup 
normalizer circuits can be efficiently simulated classically (theorem 5).^ 

We complete our analysis of the HNSP, which we reduced to the abelian HSHP (result L), 
showing that our normalizer circuit model encompasses an earlier HSHP quantum algo¬ 
rithm based on a variant of Shor-Kitaev’s quantum phase estimation, which was proposed 
by not fully analyzed by Amini-Kalantar-Roozbehani in [46, 47]. Using our stabilizer for¬ 
malism, we prove the latter to be inefficient on easy instances, and, thereby, point out the 
abelian HSHP as the first known commutative hidden substructure problem in quantum 
computing that cannot be solved by standard phase estimation. In spite of this no-go 
result, we also show, in our last main contribution, that in the interesting cases from 
the nonabelian HSP perspective, the abelian HSHP can actually be solved with a novel 
adaptive/recursive quantum Fourier sampling approach: 

IV. New quantum algorithms. We present the hrst provably efficient quantum algo¬ 
rithm for finding hidden subhypergroups of nilpotent^ abelian hypergroups, provided 
we have efficient circuits for the required QFTs. This algorithm also leads, via the 
connection above (result I.), to a new efficient quantum algorithm for the HNSP 
over nilpotent groups that directly exploits the abelian hypergroup structure and is 
fundamentally different from the algorithm of Hallgren et al. [12]. 

Our correctness proofs for these last quantum algorithms can further be extended to crucial 
non-nilpotent groups^ (and their associated class hypergroups) such as the dihedral and 
symmetric groups.^ In contrast, no efficient quantum algorithm for the nilpotent, dihedral 
and symmetric HSPs is known. This provides strong evidence that abelian HSHP is a 
much easier problem for quantum computers than nonabelian HSP, and, because of its 
Shor-like connection with a stabilizer formalism, perhaps even a more natural one. 

^Here, we rely on computability assumptions (section 6.1) that are always fulfilled in [40, 41]. 

^These are conjugacy class hypergroups associated to nilpotent groups [51]. The latter form a large 
group class that includes abelian groups, Pauli/Heisenberg groups over Zpr with prime p, dihedral groups 
D 2 N with N = 2", groups of prime-power order and their direct products. 

®We give another algorithm that works for all groups under some additional mild assumptions. 

^For dihedral groups/hypergroups we give a quantum algorithm; for symmetric ones, a classical one 
already does the job because symmetric groups/hypergroups have few normal subgroups/subhypergroups. 
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Applications 

Though lesser known than nonabelian groups, abelian hypergroups have a wide range of 
applications in convex optimization (cf. association schemes [52, 53]), classical cryptogra¬ 
phy, coding theory [54], particle physics [55], conformal field theory [56]. In topological 
quantum computation [45], fusion-rule hypergroups [57] are indispensable in the study of 
nonabelian anyons [57]. Our stabilizer formalism over the latter hypergroups likely has 
applications for quantum error correction and for the simulation of protected gates over 
topological quantum held theories [58]. 

The stabilizer formalism and classical simulation techniques presented in this paper 
are unique in that they are the hrst and only available methods to manipulate stabilizer 
operators that neither unitary, nor monomial, nor sparse that we are aware of [59]. Fur¬ 
thermore, our stabilizer formalism yields the hrst known families of qubit/qudit stabilizer 
operators for any arbitrary hnite dimension d that are not the standard Weyl-Heisenberg 
operators [39], with associated normalizer gates that are not the standard qudit Clifford 
gates. Additionally, our methods allow great hexibility to construct new codes because 
the stabilizer families can be chosen over any hypergroup of interest. 

Relationship to prior work 

Normalizer circuits associated to abelian groups have been extensively studied in earlier 
works of Van den Nest, Bermejo-Vega and Lin [40-42, 36]: in [40, 41], the groups were 
hnite and given in an explicitly decomposed form Z^Vi x • • • x [42] further considered 

inhnite group factors^ (integers, hypertori) and inhnite dimensional quantum gates; [36] 
added matrix group factors (like Z^) and black box groups [36]. The circuits in [40-42] 
were proven to be efficiently simulable by classical computers using abelian group stabilizer 
formalisms. Those in [36] were shown to be powerful enough to implement Shor’s and 
abelian HSP quantum algorithms. Moreover, simulating them was shown to be at least as 
hard as factoring and exactly as hard as decomposing hnite abelian groups. 

Our efficient classical simulation result (theorem 5) is not a full generalization of 
the Gottesman-Knill theorem [37, 38], like the one developed in [40, 41], but of its CSS- 
preserving variant [60] without intermediate measurements. In our work, we dedicate 
most effort to cope with the highly nontrivial difficulty that our Pauli operators are non¬ 
monomial and non-unitary, which renders all existing stabilizer formalism techniques 
[37-42, 36, 61-65, 59, 66] inapplicable. To tackle this issue, we develop new simulation 
techniques based on hypergroup methods, up to a fairly mature state, though further 
improvement remains possible (see section 6 for a discussion and a related conjecture). 

The Group Stabilizer Formalism of [40-42] was applied in [36] to show that the prob¬ 
lem of decomposing hnite abelian black-box groups, which can be solved by a quantum 
algorithm due to Cheung and Mosca [7, 8], is complete for the complexity class associ¬ 
ated to black-box group normalizer circuits; thereby, proving no-go theorem for hnding 
new quantum algorithm better than Cheung-Mosca’s. The authors of [36] raised the open 
question of whether normalizer circuits over different algebraic structures could be found 
and be used to bypass their no-go theorem. Our quantum algorithms for abelian HSHPs 
answer their question in the affirmative: the circuits we use to solve that problem are 
instances of normalizer circuits over nonabelian groups / hypergroups (section 7). 

The hidden subhypergroup problem (HSHP) we discuss was hrst considered by Amini, 
Kalantar and Roozbehani in [46, 47], yet (to the best of our knowledge) no provably efficient 

^Though we have not considered infinite hypergroups, many of our results should extend to locally 
compact abelian hypergroups (see [47] and the discussion in [42] about locally compact abelian groups). 
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quantum algorithm for this problem has been given before. We show that an earlier quan¬ 
tum algorithm proposed in [47] for solving the problem using a variant of Shor-Kitaev’s 
quantum phase estimation [2] is inefficient on easy instances (section 7). Interestingly, this 
means that abelian HSHP is the first known commutative hidden substructure problem 
that cannot be solved by standard phase estimation. Instead, our quantum algorithm is 
based on a novel adaptive/recursive Fourier sampling quantum approach. 

In this work, classical simulation techniques played a role in the development of the 
quantum algorithms we present. In this way, our results relate to other projects where 
classical simulations methods helped to find new quantum algorithms [67, 68] or complexity 
theoretic hardness results [69, 70, 36, 71]. 

For any non-abelian group G, the simulation results we present lead to efficient classical 
algorithms for simulating quantum Fourier transforms over G (specihcally, as employed in 
weak Fourier sampling routines) acting on coset states \aH), a G G, H C G such that aH 
is invariant under conjugation®. In this sense, our work connects with [72], where efficient 
classical algorithms were given for simulating weak and strong quantum Fourier sampling 
on arbitrary coset states of semi-direct products group Zp k A, where p is prime and A is 
an abelian group given in a canonical form Z^r^ x • • • x Z 7 v„, • 

Finally, we mention that the results in [40-42, 36] and the results in the present work 
are not contradictory. Briefly, the efficient simulations in [40-42] are possible because 
more knowledge about the normalizer circuits structure is given (namely, cyclic factor de¬ 
compositions of the associated finite groups), but in [36] this information is missing and 
normalizer circuits become useful to identify hidden structures (cf. reference for extended 
discussion). Similarly, in our work, some hypergroups with stronger computability proper¬ 
ties lead to efficiently classically simulable circuits, while other lead to valuable quantum 
algorithms (see section 6.1 and appendix C). 

Structure of the paper 

We give a non-technical introduction to the theory of hypergroups in section 2. We 
then re-introduce the hidden normal subgroup problem (HNSP) and prove its connection 
to the hidden subhypergroup problem (HSHP) in section 3. We present our models of 
hypergroup normalizer circuits, our hypergroup stabilizer formalism, and our simulation 
results in sections 4-6 and describe these on some examples. Finally, we use these tools 
to develop new quantum algorithms for abelian HSHP and HNSP in section 7. 

While our motivation for developing our hypergroup stabilizer formalism was to un¬ 
derstand more about the HNSP, we note that the results of sections 4-6 are more general, 
as they apply to arbitrary hypergroups. We expect that these tools will have applications 
outside of the analysis of quantum algorithms such as to the development of new error 
correcting codes. 

2 Abelian hypergroups and hypergroup duality 

This section is an introduction for quantum computer scientists to the beautiful theory of 
finite abelian hypergroups'^, whose origin dates back to works by Dunkl [76], Jewett [77], 
Spector [78] in the 70s. Our account is based on [73-75, 79, 80, 56, 81, 82] and borrows 

®This happens, e.g., if aH = N for normal N or if the subgroup H contains the derived subgroup [G, G]. 

^The hypergroups we consider are frequently called “finite commutative hypergrops” in mathematics. 
We call them “abelian” because of the focus of this work on abelian and nonabelian HSPs. In some of our 
references [73-75], the hypergroups in this work are called ^‘‘reversible abelian hypergroups”. 
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most notation and terminology from [56, 79-81]. Throughout the paper, hypergroups and 
groups are assumed to be finite unless said otherwise. 

In brief, abelian hypergroups are algebraic structures that generalize abelian groups, 
although in a different way than nonabelian groups. Despite being less known than the 
latter, abelian hypegroups have a wide number of applications in multiple fields, including 
combinatorics, convex optimization [52, 53]; cryptography, classical error correction [54]; 
classical information theory [56]; particle physics [55] and conformal field theory [56], to 
begin with. In topological quantum computation [45], certain hypergroups known by the 
names of “fusion theories or categories” [56, 57] are invaluable in the study of topological 
order and nonabelian anyons [57]. 

On top of their versatility, abelian hypergroups also admit a simple and intuitive 
physical definition, which we give now before going into the full mathematical details of 
their theory. In simple terms, a finite abelian hypergroup T is a set of particle types 
{xo,xi,... ,Xn} that can collide. When Xi collides with Xj a particle Xk is created with 
probability Furthermore, a non reactive vacuum particle xq will be created with 
non-zero probability by such process iff xt is the antiparticle of Xk (which always exists). 


2.1 Definition 


We now turn the intuitive definition of hypergroup above into a precise mathematical one. 

A finite abelian hypergroup T = {xq, xi,..., x^} is a basis of a commutative complex 
C* algebra A{T) = CT, called the hypergroup algebra of T, with a particular structure. 
AfT) is endowed with an associative commutative hyper operation 

n 

VxjjXj G T, (1) 

k=0 


which returns a superposition of outcomes in T (we write “xfc G XjXj” when Xk is a possible 
outcome of XiXj, with / 0 ); a multiplicative identity xq = 1; and an involution xi^Xi. 
Note that commutativity and the presence of the involution imply that n‘L^ = 
holds for any a,b,c £T. 

Furthermore, the “structure constants” > 0 are real numbers with three properties: 

(i) Anti-element property. For every Xj and any Xj, the identity xq = 1 can be an 
outcome of XiXj if and only if Xj = Xj. We call x* the anti-element of Xj. 

(ii) Normalization property. For all values of A: = 0,..., n we have X]fc=o ~ ™ 

other words, n’fj is a probability distribution (of outcomes) over k. 

(iii) Reversibility.® For every x,y,z G T, it holds that z £ xy ii and only if y G xz. 
Moreover, if the weight of x is defined as := 1/n^-^, the following identity holds: 


n 


Jry 


n; 


XZ 




w,. 


( 2 ) 


As a simple example, any finite abelian group G is an abelian hypergroup. The elements 
of G define the basis of the group algebra CG and the involution is x := x~^. In the case 
of a group, though, for any i,j G there is only a single nonzero ^ since XiXj = Xk 

for some k; though hypergroups have a more complicated multiplication than groups, they 
preserve the property that the product of x and x includes the identity. 

®This last property (iii) and (2) can both be derived from the previous axioms [74]. 
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Hypergroups in this work. Though nonabelian hypergroups exist®, this paper focuses on 
abelian ones because they fulfill certain useful dualities (see below). In sections 3 and 7, 
we further focus on specific abelian hypergroups that arise from finite groups (section 2.3). 

2.2 Glossary 

We now give a glossary of hypergroup theoretic concepts for future reference. In all 
definitions below 7~ is fixed to be an arbitrary abelian finite hypergroup. 

Weight functions. Every subset X C T has a weight wx '■= Wx as in (2). 

Subhypergroup. A subhypergroup M is a subset of T that is also a hypergroup with the 
same identity, involution, structure constants and weights. 

Quotient hypergroup. For any subhypergroup J\f the quotient hypergroup T/M is an 
abelian hypergroup whose elements are the cosets aj\f := {x G T : x G a 6 for some b G M}. 
Its hyperoperation is defined [74, 80] by, first, identifying each aN with an element of the 
A{T) algebra^® via aM := ■ Then, T jM inherits a hyperoperation with 

structure constants = J2d&cX^ib ^nd weights = i-/{J2b&Ar'^x,y) = 

Morphisms. A map between two hypergroups / : T —?• is a homomorphism if f{ab) = 
f{a)f{b) = Ylc''^abfi^) /(®) ~ /(®)- invertible homomorphism is an isomorphism. 
An isomorphism from T to T is an automorphism. As with groups, isomorphic hypergroups 
have identical hypergroup-theoretic properties (weights, subhypergroups, etc.). 

Character hypergroup T* ■ A complex function : T —>■ C is a eharacter of T if it is 
not identically zero and satisfies the identity^^ 

^^( 06 ) = A’^(a)A),( 6 ) = n^^A’(c) and A’^(a) = A’^(o) for all a, 6 G T. (3) 

C 

For any abelian hypergroup T, its set T* of character functions defines an abelian signed 
hypergroup with the point-wise functional product as hyperoperation, the trivial character 
A’i(a) = 1 as identity and the complex conjugate map —)■ as involution: here, 

“signed” means that T* fulfills (i-ii-iii) but may have some negative structure constants 
rnfi^, which represent negative probabilities. If all constants m'fiy are non-negative, T* 
is a hypergroup called the character hypergroup of T, and T is said to be strong [82] . 

Throughout the paper, we assume all hypergroups to be strong (without notice) so that 

the associated character hypergroups T* define new “dual theories” of particle collisions'^ 

Weight-order duality. The hypergroups T and T* have the same cardinalities and weights: 

Wt = ^w^= ^ Wx^= Wr*. (4) 

a&T Xfj,eT* 

®In fact, every nonabelian group G is also a kind of nonabelian hypergroup. 

^°See [73] for a set theoretic definition 

^^If characters are linearly extended to act on the hypergroup algebra A{T), condition (3) becomes 
Xfiab) = Xfia)Xfib), Va, b £ A{T)\ in other words, the characters of T are also the characters of A{T). 

^^Many of the hypergroup concepts and properties presented in this section as well as our results in 
sections 4, 6 can be effortlessly extended to the setting where T is an abelian signed hypergroup, in which 
case T* is also an abelian signed hypergroup [74, 75, 82-84]). Though it seems plausible, we have not 
investigated whether our results in section 5 can be extended to signed hypergroups. In the remaining 
sections, we focus on class and character hypergroups that arise from finite groups, which are always strong. 
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Abelian hypergroup duality. The hypergroup T** of characters of T* is isomorphic to 
the original hypergroup T. This isomorphism is constructed canonically by sending a gT 
to a character 

Xa{X^)=^{a). (5) 

In particular, this shows that the hypergroups T, T* have the same number of elements. 

Remark 1 (Notation). Throughout the text, we identify dual characters Tq £ T** with 
elements a € T via the isomorphism (5). We write the hyperoperation of T* compactly 
as Xfj,Xu = 1^7 iT^]iuX-y and, occasionally, use the expression Xji as a shorthand for 

The notions of character and duality lead to a family of related concepts that are extremely 
valuable in hypergroup theory and in the present work: 

Annihilators. The annihilator Af'^ of a subhypergroup AA C T is a subhypergroup of T* 

:= g r* : X^{a) = 1 for all a G M}. (6) 

Subhypergroup duality A stronger form of hypergroup duality relates the notions of anni¬ 
hilator, subhypergroup and quotient: the annihilator is isomorphic to the characters 
{T/N)* of T/A/"; moreover, the character hypergroup N* is isomorphic to T* 

Character orthogonality. Character functions are orthogonal with the inner product 

(A^, X,) = V (7) 

Moreover, due to hypergroup and subhypergroup duality, for any subhypergroup Af C T, 
any two cosets oAf, bAf € T/Af and any A^, £ AA-*-, the following generalized orthogo¬ 

nality relationships are always fulfilled 

2.3 Examples from group theory 

We now introduce two examples of hypergroups that play a central role in our work 
(namely, in sections 3 and 7). For an arbitrary finite group, these are the hypergroups of 
conjugacy classes and of characters, which are dual to each other in the sense of (5). The 
existence of these hypergroups linked to arbitrary groups lets us apply our hypergroup 
normalizer circuit and stabilizer formalisms (sections 4-5) to nonabelian groups. 

2.3.1 The hypergroup of conjugacy classes of G 

Let G be any finite group. For any g £ G, we let Gg := {g°' \ a £ G}, where g^ := a~^ga 
denotes the conjugacy class of g. We let G be the set of distinct conjugacy classes of G. 

Let C = {fl' 1 , 52 , • • • } and D = {hi, /i 2 ,... } be two conjugacy classes. Then, for any 
product, gihj, its conjugate {gihjY = 5 f/i“ is a product of conjugates, so it can be written 
as gkhi for some k and i. Furthermore, if there are M distinct products gi^hj^,... jgi^hjj^ 
producing some element x, then the distinct products ... ■, all produce 

Thus, for each conjugacy class E arising in the product of elements of G and D, we get a 
well defined number of “how many times” that class arises, which we denote 





We will denote by A{G) the complex vector space with the distinct conjugacy classes 
as a basis, which make into a C-algebra by defining the product CD := YIe&g D^- 

We take the map Cg i—)• C^-i, extended to all of ^(G) by linearity, as our involution. 

It is easy to see that Ce arises in a product CgCh iff Ch contains 5 “^, which occurs iff 
Cfi = Cg-i. Thus, we can see that the first of the two required properties holds for the 
product with structure constants Mq jg. 

To get the normalization property to hold, though, we must make a minor change. 
For each Cg G C, define Cg to be the vector {l/\Cg\) Cg. Then we will take {cg \ Cg ^ C} 
to be a new basis. The structure constants become := j^\E\/\C\\D\. Since the 

total number of products of elements formed multiplying C hy D \s 1(7111)1, we can see 
that = |G||Z)|, which means that these new structure constants, 

are properly normalized. Thus, conjugacy classes define a hypergroup, up to this normal¬ 
ization, which we call the class hypergroup C. 

Finally, we note that this hypergroup is abelian, even if the underlying group is not 
abelian. To see this, we calculate gh = hh~^gh = hg^ = (hg)^ (since = h), which shows 
that gh and hg are in the same conjugacy class. Hence, if we are multiplying conjugacy 
classes instead of elements, we do not distinguish between gh and hg, and we get an abelian 
structure. 

2.3.2 The hypergroup of characters 

Let C denote the set of irreducible characters of the finite group of C, A{C) the complex 
vector space with basis C, and Xfj, the character of the irreducible representation /r. As 
we explain next, C has a natural hypergroup structure. 

First, the involution of C will be the linear extension of the map Xfi Wi for Xfi ^ G, 
the image also being an irreducible character. 

Second, for any two characters, Xfj, and Xct, the pointwise product of these functions 
XiiXa is also a character, though it is not necessarily irreducible. However, as is well 
known, any representation can be written as a linear combination of irreducible characters: 
X/iXo- = Y^tgg some non-negative integers Using this as our product, 

A{C) becomes a C*-algebra, where the identity element is the trivial representation, xi, 
given by xi{a) = 1 - 

Third, the coefficient as is also well known from representation theory, is given 

by (XMX(T,Xr), where (•,•) is the inner product = \G\~^ Y.g(^G ^^^^9)Xa{g)■ From 

this, we can see that = (XmX< 7 ,Xi) = (Xm>X7Xi) = (Xm>)g)- Since and are 
both irreducible, this is 1 if Xo- = X/I and 0 otherwise. Hence, we can see that the structure 
constants Ai^^^ have the first required property. 

Finally, we will normalize the characters, as in section 2.3.1, in order to have (ii). For 
this, we define C, the character hypergroup of C, to be the hypergroup with elements 

:= (9) 

where dg is the dimension of the irrep //. The structure constants now become := 
Ng^^dr/dgd(j. Since x^lX<T is actually the character of the representation 0 a, which 
splits into a direct sum of irreducible representations (as described above), we must have 
Yt£G = dgda as the latter is the dimension of the tensor product. This implies 

that (ii) is fulfilled and that C (now suitably normalized) is indeed a hypergroup. 

Finally, we note that, in this case, our product is manifestly abelian since XfiXa denotes 
the element-wise product of these functions, which takes place in the abelian group C. 
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2.3.3 The relationship between G and G 

Crucially, the characters of the hypergroup G turn out to be the normalized characters 
= Xfi/d^ of G and, due to duality (13), conjugacy classes are the characters of G. 
Classes and characters have weights Wcg = \Gg\ and respectively, where is 

the dimension of the irrep This fantastic connection between groups and hypergroups 
lets one easily derive many well known results in nonabelian group character theory [51, 85] 
using the properties of section 2.1, including the usual character orthogonality relationships 
and the famous |G| = identity: the latter can be derived from (4), which leads 

to Wc = Ycg&G ~ 1^1 ~ eG^M implies, Wq = |G| and vjq = |G'|- 

3 Understanding the Hidden Normal Subgroup Problem 

In this section, we demonstrate a formal connection between the hidden normal subgroup 
problem (HNSP) and a problem on abelian hypergroups, defined below, which we call the 
CC-HSHP. Specifically, we show that, in many cases, we can efficiently reduce the HNSP to 
the CC-HSHP, classically. This reduction tells us that, even though the HNSP is defined 
in terms of nonabelian groups, it can be translated into a problem about an algebraic 
structure that is abelian, albeit one that is more complex than a group (a hypergroup). 

In the remainder of the paper, we will see the effects of moving from nonabelian 
groups to abelian hypergroups. While the switch from groups to hypergroups creates 
some new difficulties, we also gain a great deal by working with an abelian structure. In 
particular, we will see that the mathematical structure of abelian hypergroups leads to 
a beautiful stabilizer formalism and to new quantum algorithms. Here, we explain how 
abelian hypergroups arise specifically when looking for hidden normal subgroups before 
moving to the more general setting. 

In the hrst subsection, we formally define the two problems mentioned above, the 
HNSP and the CC-HSHP. Afterwards, we show how to reduce the former to the latter. 

3.1 The HSNP and the CC-HSHP 

In the HNSP, we are given an oracle / : G —)• {0,1}*, assigning labels to group elements, 
that is promised to hide some normal subgroup N <\ G. The latter means that we have 
f{x) = f{x') for x,x' € G if and only if x' = xn for some n € N. An algorithm solves the 
HNSP if it can use this oracle and other quantum computation in order to determine the 
subgroup N with high probability. 

The algorithm of Hallgren et al. for the HNSP finds the hidden subgroup N using 
exclusively information provided by characters of the group. They showed that this works 
only for normal subgroups as it cannot distinguish a non-normal subgroup H < G from a 
conjugate subgroup / H. 

If we are only examining the characters of the group G, then it stands to reason that 
we can get the same information from the hypergroup of characters G or, equivalently, 
from the hypergroup of conjugacy classes G since these two hypergroups contain the same 
information.^^ Hence, we may expect that the HNSP on G is related to some problem on 
the abelian hypergroup G. 

A natural question for abelian hypergroups like these is the hidden subhypergroup 
problem [46]. For our abelian hypergroup of conjugacy classes, we will refer to this prob¬ 
lem as the conjugacy class hidden subhypergroup problem or CC-HSHP. Here, we are 

After all, each can be recovered from the other as its dual hypergroup. 
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given an oracle f : G ^ {0,1}*, assigning labels to conjugacy classes, that hides some 
subhypergroup, and we are asked to determine that subhypergroup via oracle queries and 
quantum computation. We will see next how this is related to the HNSP. 

3.2 Reducing the HNSP to the CC-HSHP 

Since a normal subgroup N is (the union of) a set of conjugacy classes that is closed under 
multiplication and taking inverses, it also defines a subhypergroup of G, which we denote 
by Hence, any subgroup that can be found as the solution of the HNSP can also 

be found as the solution of the CC-HSHP. Indeed, as we will see next, in many cases, we 
can directly reduce the HNSP to the CC-HSHP. 

In order to perform this reduction, we need to provide a CC-HSHP oracle. Our proofs 
will show how to translate an oracle for the HNSP into an oracle for the CC-HSHP. These 
translations assume that we can perform certain computations with conjugacy classes, 
described in detail in appendix D.2, which we refer to as “computing efficiently with 
conjugacy classes”. (While formally an assumption, we know of no group for which these 
calculations cannot be performed efficiently.) 

Theorem 1 (HNSP < CC-HSHP, I). Let G be a group. Suppose that we are given a 
hiding function / : G —)• {0,1}* that is also a class function®. If we can compute efficiently 
with conjugacy classes, then we can efficiently reduce this HNSP to the CC-HSHP. 

“This means that / is constant on conjugacy classes. This will occur iff G/N is abelian, where N is the 
hidden subgroup. 

Proof. The assumptions about computing efficiently with conjugacy classes imply that, 
given a conjugacy class Cg, we can efficiently find an element x € Cg and apply / to get 
a label. (Since / is a class function, the label is the same for any x' G Cg.) Let N be the 
hidden subgroup. Since / hides N and N is normal, we can see that f{xn) = f{{xn)^) = 
f{x°‘rf‘) = /(x“) = f{x°‘n') for any n, n' G N. This shows that / is constant on CgNc, 
which corresponds to a coset of the subhypergroup Nq < G. It follows immediately that 
/ has distinct values on distinct cosets of so we can see that / is a hiding function 
for this subhypergroup corresponding (uniquely) to N. □ 

Theorem 2 (HNSP < CC-HSHP, H). Let G be a group. Suppose that we are given a 
hiding function f : G ^ H that is also a homomorphism. If we can efficiently compute with 
conjugacy classes of G and H, then we can efficiently reduce this HNSP to the CC-HSHP. 

Proof. Consider any element x G G. For any conjugate for some a G G, we see that 
/(x“) = f{a~^xa) = f {a~^)f (x)f (a) since / is a homomorphism. Furthermore, since 
a~^a = e, we see that f{a~^)f{a) = /(e) = e, which shows that f{a~^) = f{a)~^. Putting 
these together, we have /(t“) = f {a)~^ f (x) f {a) = f{x)f^°‘\ This means that the function 
/ taking x to the conjugacy class label of f{x) is a class function, which we can compute 
efficiently by assumption. Thus, by the same proof as in previous theorem, we can reduce 
this to the CC-HSHP. □ 

This latter theorem applies to many of the important examples of HSPs. This includes 
the oracles used for factoring, discrete logarithm over cyclic groups and elliptic curves, 
and abelian group decomposition [36]. While all of these examples are abelian groups, it 

distinguish this from N, which is a set of group elements, because Nq is a set of conjugacy classes. 

'^^Also note that, since e is the only element in its conjngacy class, / hides the same snbgronp as /. 
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is true in general that, for any normal subgroup of any group, there is always some hiding 
function that is a group homomorphism.^® 

From these proofs, we can see that the essential difference between the HNSP and 
the CC-HSHP is the slightly differing requirements for their oracles. We have seen that, 
whenever we can convert an oracle for the former into one for the latter, we can reduce the 
HNSP to the CC-HSHP. Above, we showed this can be done in the case that the two sets 
of requirements are actually the same (theorem 1) and the case where the labels produced 
by the oracle are not opaque but rather come with enough information to compute with 
their conjugacy classes (theorem 2). 

Apart from this, it is worth reflecting on which of the types of oracle is the most 
sensible for the problem of hnding hidden normal subgroups. With this in mind, we note 
that the oracle in the HNSP is not specific to normal subgroups: the same type of oracle 
can hide non-normal subgroups as well — we are simply promised that, in these cases, 
the hidden subgroup happens to be normal. In contrast, the oracle in the CC-HSHP can 
only hide normal subgroups because it is required to be constant on conjugacy classes. 
Hence, even though we came upon the oracle definition from the CC-HSHP by looking at 
hypergroups, it is arguable that this is actually a better definition of hiding function for 
normal subgroups. Our proofs above demonstrate that, whenever we are given an oracle 
of this type, we can reduce finding the hidden normal subgroup to the CC-HSHP. 

We will return to the HNSP in section 7. There, we will show that the CC-HSHP 
can be efficiently solved on a quantum computer under reasonable assumptions. This, 
together with the theorems above, show that the HNSP is easy because the CC-HSHP is 
easy, which gives an explanation for why the HNSP is easy in terms of the presence of an 
abelian algebraic structure. 

Before we can do that, however, we need to first develop some tools for analyzing quan¬ 
tum algorithms using abelian hypergroups. These tools will be of independent interest. 

4 Normalizer circuits over abelian hypergroups 

In section 3, we described our motivating example (the hidden normal subgroup problem) 
for considering how abelian hypergroups can be used to understand quantum computation. 
There, the abelian hypergroups arose from nonabelian groups. However, there are a vast 
number of interesting hypergroups with applications in physics and mathematics [56], 
including many of the ones used in topological quantum computation [45, 45], that do 
not arise from groups. So in the next three sections, we will work with a general abelian 
hypergroup T, which could come from any of these settings. 

Our plan in these next few sections is to follow the model that allowed abelian groups to 
be used so successfully to understand quantum computation [40-42, 36]. We will see that 
much of the same machinery developed with abelian groups can also be developed with 
abelian hypergroups. While new difficulties appear, many of the most useful properties 
remain. Since abelian hypergroups generalize abelian groups, our constructions generalize 
those for abelian groups as well. 

We start, in this section, by defining the class of circuits that we will analyze. We call 
this model, defined in section 4.1, normalize!’ circuits over hypergroups. In section 4.2, we 
go through a few examples of what these models consist of for different hypergroups. In 
later sections, we develop a stabilizer formalism and a Gottesman-Knill-type theorem that 
applies to these circuits. 

H < G is the hidden subgroup, then one example is the canonical oracle G —>■ G/H given by a; i—>■ xH. 

^^This also assumes the relatively minor assumption that we can compute with conjugacy classes. 
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4.1 Circuit model 


Fix T to be an arbitrary finite abelian hypergroup. We now define a circuit model, which 
we call normalizer circuits over 7~. The gates of these circuits are called normalizer gates. 


The Hilbert space: Normalizer gates over T act on a Hilbert space T-Lj- with two or¬ 
thonormal bases, B 7 - = {|a),o G T} and B 7 -* = G T*}, labeled by elements and 

characters of that are related via the quantum Fourier transform (QFT) of T: 




'UJ'Y * 


aST 


WaWx-^ 

VJ-Y 


X^{a)\a). (10) 


Character orthogonality (7) implies that (10) is a unitary transformation. 


Registers: Because in many settings it is important to split a quantum computation in 
multiple registers, we let T and T-ij- have a general direct product and tensor product form 

T = Tix---xTm <—> Hr — T-Lti ® • • • ^T-LTm- (H) 

In this case, the QFT over T is the tensor product of the QFTs over the 7i’s: 

Ft = ® ( 12 ) 

Input states: Each register FLj-^ is initialized to be in either an element state \xi),Xi G % 
or in a character state G T*. 

Gates: The allowed normalizer gates at step t of a normalizer circuit depend on a param¬ 
eter T{t), which is a hypergroup, related to 7~, of the form 

T{t) = T{tfi X • • • X T{t)m with T{tfi G {71, 71*}. (13) 

The role of T(t) is to indicate whether the operations carried out by circuit at time t will 
be on the element or character basis. At step 0, T(0) is chosen so that 71(0) G {Ti,T*} 
indicates whether TLji begins on an element or character state. At any steps t > 0, 7~{t) 
depends on the gates that have been applied at earlier steps, following rules given below. 

Normalizer gates at time t can be of four types: 

1. Pauli gates. Pauli gates of type X implement the T{t) hyperoperation Xr(t){a)\b) = 
\ab) for invertible elements a G T{t). Pauli gates of type Z multiply by phases 
Zr(t)iXfj_)\b) = Xf^{b)\b) which correspond to invertible characters in T{t)*. 

2. Automorphism Gates. Let a : T{t) ^ 7~{t) be an automorphism of the hy¬ 
pergroup T{t). Then the automorphism gate Ua taking \g) 1 — \a{g)) is a valid 
normalizer gate. 

3. Quadratic Phase Gates A complex function ^ : T(t) —)• U{1) is called “quadratic” 
if the map B{g,h) : T{t) x T{t) —)■ t/(l) defined by ^(gh) = ^{g)f,{h)B{g,h) is a 
bi-character, i.e., a character of the hypergroup in either argument. A quadratic 
phase gate is a diagonal map taking \g) 1 —)■ f,{g)\g) for some quadratic function 

4. Quantum Fourier Transforms. A global QFT implements the gate 7^T(i) over 

T{t) (10). Partial QFTs implement the gates on single registers TL-pipi (while 

the other registers remain unchanged). 


^®Note that duality (5) implies dim "Hr = dim "Hr*- 
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Update rule: Because QFTs change the hypergroup that labels the standard basis (10), 
the rules above do not specify which normalizer gates should be applied on the second 
step. For this reason, in our gate model, we update the value of T(t + 1) at time t + 1 so 
that T{t + l)i = T(t)t if a QFT acts on T{t + l)j = T{t)i otherwise. 

Measurements: At the final step T, every register T-L-ji is measured in either the element or 
the character basis depending on the configuration of the QFTs in the circuit: specifically, 
'Hj-- is measured in basis 67 ^ labeled by elements of 7) when T{T)i = Ti, and in the 
character basis B 7 -* when T{T)i = 7)*. In the end, the final string of measurement 
outcomes identifies an element of the hypergroup T{T). 

4.2 Examples from group theory 

We now give examples of normalizer gates over conjugacy class and character hypergroups 
with the aim to illustrate our definitions and, furthermore, show how our results can be 
applied to define models of normalizer circuits over nonabelian groups. 

Example 1: Clifford and abelian-group normalizer circuits 

For an abelian group G, all conjugacy classes contain a single group element. Consequently, 
the class hypergroup G is always a group and it is equal to G. In this scenario, our gate 
model coincides with the finite abelian-group normalizer-circuit model studied in [40, 41], 
which contain numerous examples of normalizer gates. Choosing G = Z 2 or G = Z^, 
normalizer circuits become the standard Clifford circuits for n-qubits [38] and n-qudits 
[39]. More exotic examples are given in [40, 41] for the case G = Z^;^ x • • • x Z^^, where 
normalizer circuits can contain quantum Fourier transforms, powerful quantum gates used 
Shor’s algorithm [ 1 ]. 

All the above examples of normalizer circuits are efficiently classical simulable [40, 41]. 
More exotic instances of abelian-group normalizer circuits that cannot be be simulated 
[36] include groups of the form G = solutions of elliptic curves and, in general, finite 
abelian groups that cannot be efficiently written in the form Z^j x • • • x In this case, 
it is shown in [36] that Shor’s discrete-log quantum algorithm is a normalizer circuit over 
Zip-i X Zjp] a similar result is proven in [36] for Shor’s factoring, which can be understood 
as a normalizer circuit over an infinite group (which we do not consider in this paper 

Example 2: normalizer circuits over nonabelian groups 

We now apply our circuit formalism to introduce (new) models of normalizer gates over 
any finite nonabelian group G. For this, we associate a Hilbert space T-Lg to G with 
basis {\g),g G G} and restrict the computation to act on its (nontrivial) subspace Iq of 
conjugation invariant wavefunctions.^® 

As is well-known from representation theory [85], the Dirac delta measures 5cg over 
conjugacy classes Gg G G and the character functions Xu the irreducible representations 
p, G Irr(G) form two dual orthonormal bases of Iq. In our circuit model, recalling the 
definitions of class hypergroup G and character hypergroup G (see section 2.3), this means 
that % can be viewed as the Hilbert space of the conjugacy class hypergroup T-Lq with a 
conjugacy-class basis = {\Gg),Cg G G} and a character basis Bg = {\Xg),Xg G G} if 

^®See also [42] for more general types of normalizer circuits over infinite abelian groups. 

^°That is, wave functions tpix) such that ?/)(a:®) = ip(x) for all x,g G G. 
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we define these bases within %g as the vectors 

1 / (p _ 

= \aga~^) and \X^) = d-^ '^Xf,{g)\g). (14) 

V aga-ieCg ^ ' g&G 

With these identifications, we can now define a normalizer circuit over G to be a 
normalizer circuit over the hypergroup G: the latter acts on the conjugation invariant 
subspace, admits conjugacy class and character state inputs, and applies QFTs, group 
automorphisms, and quadratic phase functions associated to G and G. Furthermore, if we 
have a direct product G = Gi x • • • x Gm, then G = Gi x • • • x Gm, G = Gi x • • • x Gm 
and T-Lq = T-Iq^ (8) • • • <8> setting, normalizer gates such as partial QFTs and 

entangling gates over different registers are allowed. 

It is straightforward to check, using the identities Wcg = |Gg|, and Wa = 

= |G| (section 2.3), that the QFT defined with the bases from (14) is actually the 
identity map. Even so, the QFT performs a useful purpose in these circuits as it changes 
the basis used for subsequent gates, T{t + 1). In particular, the QFT can change the final 
basis to the character basis, which means that the final measurement is performed in the 
character basis rather than the element basis. 

As we show in appendix D, we can perform a final measurement in the character basis 
provided that we have an efficient QFT circuit for the group G. The same techniques also 
allow us to prepare initial states and perform all the gate types (Pauli gates, automor¬ 
phisms, and quadratic phases) in the character basis efficiently. 

Performing the gate types in the conjugacy class basis is straightforward if we make 
some modest assumptions about our ability to compute with conjugacy classes of the group. 
For example, we need a way to map an element G G to a label of its conjugacy class Gg. 
These details are discussed in appendix D.2, where we explain why these assumptions are 
easily satisfied for typical classes of groups. 

Example 3: quaternionic circuits 

Lastly, we give concrete examples of normalizer gates over nonabelian groups for systems 
of the form Qg where Qg is the quaternion group with presentation 

Qs = (-l,b j,^l(-l)^ = 1,1^ = f = k^ = ijk = -1) (15) 

Note that Qg is nonabelian and that, although it has eight elements ±1, ±f, ±j, Xk, it has 
only five conjugacy classes {1}, { — 1}, {±f}, {ij}, {±fc}. Hence, although the Hilbert 
space 'Hq^ = {Id) ■ 9 ^ Qs} is 8^-dimensional, our quantum computation based on 
normalizer gates will never leave the 5”’-dimensional conjugation invariant subspace 
which can be viewed as a system of 5-dimensional qudits. Using the group character table 
[86], it is easy to write down the conjugacy class and character basis states of T~l^: 

• Conjugacy-class states: 

|Gi) = |l), |G_i) = |-l), |G,) = ^^, |G,) = ^^, |GQ = M^ 
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• Character states: 


l^fi) = ^ (iCi) + |C_i) + ^/2|a) + V2\Cj) + V2\Ck)) , 

\Xi) = (iCi) + |C_i) + V2\Ci) - V2\Cj) - V2\Ck)) , 

l^i) = ^ (iCi) + \C-i) - V2\C,) + ^/2|C,) - V2\Ck)) , 

\Xk) = (iCi) + |C_i) - V2\Ci) - V2\Cj) + V2\Ck)) , 

|^2) = ^(|Ci)-|C_i)), 

We now give a list of nontrivial normalizer gates (not intended to be exhaustive), which we 
obtain directly from the definitions in section 4 applying basic properties of the quaternion 
group [51, 86]. For the sake of conciseness, the elementary group-theoretic derivations are 
omitted. 

• Quantum Fourier transform. For one qudit, the QFT implements the change of 
basis between the conjugacy-class and character bases written above. For n-qudits, 
the total QFT implements this change of bases on all qudits. Partial QFTs, instead, 
implement the QFT on single qudits. 

• Pauli gates: Xq^{-1)\Cx) = \-Cx), Zq^{X()\Cx) = X(,{Ca,)\Cx) for ^ = i,j,k. 

• Automorphism gates: All automorphisms of the class-hypergroup can be obtained 
by composing functions Oxy that swap pairs of conjugacy classes Cx, Cy with G 

The corresponding swap gates Ua^^\Cz) = \axyiCz)) are instances of one- 
qudit quaternionic automorphism gates. 

• Quadratic phase gate. Next, we give examples of non-linear quadratic phase 
gates. For one qudit, quadratic phase gates D^., D^., defined as 

D^JCy) = \Cy), if y G {x) = {±l,±x} and D^JCz) = i\Cz) otherwise, 

provide quaternionic analogues of the one-qubit P = diag(l,i) Clifford gate. 

For two qudits, there is also a ^^quaternionic controlled-Z gate" D^, which implements 
a quadratic function ^{Cx, Cy) = fc^ (Cy), with fc^ being a linear character specified 
by the following rules: /c±i = Xi and fc^ = Xx for x = i,j, k. We refer the reader 
to appendix B for a proof that the above functions are quadratic. 

Most of the above gates act on a single copy of and, thus, cannot generate en¬ 
tanglement. Entangling normalizer gates can be found by considering two copies of T-Lq^. 
The allowed normalizer gates are now those associated to the group Qs x Qs- 

We give next three examples of two-qudit automorphism gates Ucn, Uaj, Uak-, that 
can generate quantum entanglement and provide quaternionic analogues of the qubit 
CNOT [38] and the qudit CSUM gates [39]. The three are defined as 

t/aJCi,C’2) = |a..(Ci,C2)) = \CrJx{Ci)C2) (16) 

where fx{Cy) = Ci if Cy is contained in the subgroup (x) = {±1, ±x} generated by x and 
fx{Cy) = C-i otherwise^^. The action of any of these gates on the product state \Xi)\Ci) 

^^The function A defines a group homomorphism from Qg into its center Z{Qs)- Using this fact, it is 
easy to show that is a group automorphism. 
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generates an entangled state; we show this explicitly for [/„.: 

Ua^Xl)\Cl) = i + la)) |Ci) + i {\Cj) + \Ck)) |C_i). 

Quaternionic quadratic-phase gates can also generate highly entangled states. For 
instance, the action of on a product state \Xi)\Xi) creates an entangled bi-partite 
state with Schmidt rank 4, which is close to the maximal value of 5 achievable for a state 
in 

D^\X^)\Xi) = i lA'i) + \c,)\x,) + \Ci)\X,) + \Ck)\Xk)) . (17) 

A quaternionic analogue of the {d = 4) qudit cluster state [87] displaying multi-partite 
entanglement can prepared by repeatedly applying to all pairs of neighboring qudits 
on a lattice, chosen to be initially in the state \Xi). 

As this example shows, while normalizer circuits have fairly simple algebraic properties, 
they can produce states that are very complicated and often highly entangled. Thus, as in 
the abelian case, it comes as a surprise that these circuits can often be classically simulated 
efficiently, as we will see in section 6. 

5 A Hypergroup Stabilizer Formalism 

In this section we develop a stabilizer formalism based on abelian hypergroups that extends 
Gottesman’s PSF [37-39] and the abelian group extension of [40-42, 36]. We apply our 
formalism to the description of new types of quantum many-body states, including hyper¬ 
group coset states and those that appear at intermediate steps of quantum computations 
by normalizer circuits over hypergroups. 

This section is organized as follows. In section 5.1, we introduce new types of Pauli 
operators based on hypergroups that have richer properties than those of [37-42, 36]: most 
remarkably, they can be non-monomial and non-unitary matrices. In section (section 5.2) 
we show that commuting stabilizer hypergroups built of the latter Paulis can be used to 
describe interesting families of quantum states, which we call hypergroup stabilizer states, 
as well as track the dynamical evolution of hypergroup normalizer circuits (theorem 3). 
In section 5.3, we give a powerful normal form (theorem 4) for hypergroup stabilizer 
states that are CSS-like [48, 49] . The latter will be an invaluable tool in our paper, which 
we use to describe hypergroup coset states (equation 31, corollary 1) and analyze the 
quantum algorithms of section 7. The techniques in this section will also be the basis of 
the classical simulation methods developed in section 6. 

The fact that our hypergroup stabilizer formalism is based on non-monomial, non- 
unitary stabilizers introduces nontrivial technical difficulties that are discussed in detail 
in sections 5.1-5.2. The techniques we develop to cope with the issues are unique in the 
stabilizer formalism literature since both the original PSF and all of its previously known 
extensions [37-42, 36, 61-65, 59, 66] were tailored to handle unitary monomial stabilizer 
matrices. For this reason, we regard them as a main contribution of our paper. 

Like in previous section, we develop our stabilizer formalism over arbitrary abelian 
hypergroups. Throughout the section, we fix T = 7i x • • • x Tm to be an arbitrary finite 
abelian hypergroup with Hilbert space Ht — 'Hti ® • • • G . 

5.1 Hypergroup Pauli operators 

We introduce generalized Pauli operators over T acting on T-ij- with analogous properties 
to the qubit and abelian-group Pauli matrices [40-42]. In our formalism Pauli operators 
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perform operations associated to the abelian hypergroups of section 4. First, Pauli opera¬ 
tors over a hypergroup T (18) implement multiplications by hypergroup characters as well 
as the hypergroup operation of T. For the character group T *, Pauli operators over T* 
are defined analogously (19). More precisely, for all x,y gT, G T* , we define 


Zr(X^)\x) :=X^{x)\x), 

^T{x)\y) ■■= 

(18) 


z&T 


Zr*{x)\X^) ■.= X^{x)\X^), 

Xr^{X^)\X,) := 

(19) 




With this definition, Pauli operators over a product T = 7i x • • • x Tm inherit a tensor 
product form Xr{a) := ■®Xr^{am) and Zr{X^) = • •®^r,„(A)j„). 

Any operator that can be written as a product of operators of type X-j-(a) and Z^iXiJ,) 
will be called a generalized hypergroup Pauli operator. 

We state a few main properties of hypergroup Pauli operators. First, it follows from 
(18) that the Pauli operators Zr{X^) commute and form a hypergroup isomorphic to T*: 

Zr{X^)Zr{X,) = Zr{X,)Zr{X^) = ml,Zr{X-,), for any X,gT*. (20) 

7 

Although it is not obvious from the definitions, we show later (theorem 3, eq. 26) that 
the X-Paulis Xr{a) are also pair-wise commuting normal operators, which are diagonal 
in the the character basis {\X^),X^ G 7~*}, and form a faithful representation of the 
conjugacy-class hypergroup. Precisely, for any a,b G T, X^ G T*, we have 

Xr{a)\X^) = X^ia)\X^), Xria)Xrib) = Xr{b)Xr{a) = j;<,Ar(c). (21) 

C 

The following lemma characterizes when Pauli operators of different type commute. 
Lemma 1 (Commutativity). The operators Xr{a), Z^{X^) commute iff X^{a) = 1. 

Proof. For any state \b) in the basis B 7 -, compare Zr{X,)Xr{a)\b) = E, y^<6^4c)|c) 

with Xr{a)Zr{Xij,)\b) = Ec • Then, the “if” holds because A)j(a) = 1 im¬ 

plies Xfj,{b) = Xfj_{c) for any b gT, c G ab [82, proposition 2.4.15], and the two expressions 
coincide. Conversely, letting 6 = e in these two expressions yields the “only if”. □ 

Note that the above properties are always fulfilled by qubit [38], qudit [39] and group Pauli 
operators [40, 41]. In this sense, hypergroup Pauli operators provide a generalization of 
these concepts. Yet, as we will see in the next section, there are some remarkable properties 
of group Pauli operators that are fully shared by their hypergroup counterparts. 

5.2 Hypergroup stabilizer states 

We will now extend the notion of stabilizer state from groups to hypergroups. 
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Definition 1 (Stabilizer hypergroup and stabilizer state). A stabilizer hypergroup 
is a hypergroup of commuting hypergroup Pauli operators over T (18-19) with an 
associated stabilizer function X that selects an eigenvalue X{U) for every U in S^. 

Let be a collection of r mutually commuting stabilizer hypergroups. Then, a 

quantum state lip) is called a stabilizer state stabilized by if, up to normalization 

and global phases, it is the unique non-zero solution to the system of spectral equations 

U\^f) = XiiU)\i>), for aliu £S^\i = l,...,r. (22) 

By definition, every function Aj is further constrained to be a character of This is 
necessary for the system ( 22 ) to admit nontrivial solutions. “ 

“Let UV = for any U,V ^ Sf' with structure constants sffy Then (22) implies UV\Tp) = 

X{U)\{V)\ip) = ®^V'^(1L)|'!/i). Since I?/)) 7 ^ 0, every non-zero A must be a character (by definition). 

In this work we focus on pure stabilizer states and do not discuss mixed ones. 

Though, in the PSF and in the group GSF [37-42, 36], stabilizer groups can always 
be described efficiently in terms of generators or matrix representations of morphisms, the 
existence of efficient descriptions is hard to prove in the hypergroup setting. The stabi¬ 
lizer hypergroups in our paper (see section 5.3) have efficient poly log |T|-size classical 
descriptions (where |T| is the dimension of the Hilbert space T-It) if poly-size descriptions 
for the subhypergroups of T and T* are promised to exist. We highlight that this latter 
condition is fulfilled for many hypergroups of interest, including conjugacy class and char¬ 
acter hypergroups, and anyonic fusion rule theories^^. The stabilizer hypergroups obtained 
from all those cases provide a powerful means to describe quantum many-body states that 
are uniquely defined via an equation of the form ( 22 ). 

The definition of stabilizer hypergroup and state generalizes the standard notions used 
in the PSF and the Group Stabilizer Formalism. At the same time, our hypergroup Paulis 
also have novel interesting properties that are explained next. 

Comparison 1 (Relationship to group stabilizer states.). All qubit, qudit, and 
abelian-group stabilizer states [37-41] are instances of hypergroup stabilizer states over 
an abelian hypergroup G, where G chosen to be a group of the form Z™, Z™, and ZjVj x 
••• X Ztv^ (respectively) with X{U) = -|-1. Hypergroup Pauli operators and stabilizer 
hypergroups over G (18) become standard Pauli operators and stabilizer groups over G 
(in the notation of [41]; cf. section 3 therein). 

Comparison 2 (Subtleties of hypergroup Pauli operators.). Interestingly, in spite of 
having some Pauli-like mathematical properties (section 5.1), hypergroup Pauli operators 
are not as simple as group Pauli operators [37-41]: namely, they are not necessarily unitary 
and no longer monomial ( 1 -sparse) matrices because the hyperoperations in (18) are non- 
invertible and return multiple outcomes. The absence of these two properties is reflected 
in definition 1. In our formalism, stabilizer hypergroups of commuting Paulis do not 
necessarily form groups. Stabilizer states are no longer restricted to be -|-1-eigenstates of 
hypergroup Pauli operators t/ £ 5"^, as in [37-41], for Pauli operators can now have zero 
eigenvalues®. This allows us to include more states in the formalism. 

“This follows from (18 because nonabelian group and hypergroup characters can take zero values [79, 47]. 

^^All examples mentioned belong to a class of so-called resonance hypergroups T that have integral 
weights, Wa,, and fulfill a Lagrange theorem [80], which says that -oojyf for any subhypergroup N <ZT always 
divides zo-r. As in the finite group case [40, 41], this implies that a random set {ui,..., Um} C T generates 
T via hyperoperations with high probability fl(l — ^). 
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Comparison 3 (Non-commutativity up to a phase.). Hypergroup Paulis do not 
satisfy an identity of the form Z^{X^)Xj-{a) = X^{a)X-T-{a)Z.T-{Xfj,) in general, althongh 
this is the case when T is a, group [40, 41], In our setting, this is fulfilled only in some 
special cases, e.g., when either a or is an invertible hypergroup element (theorem 3, 
eq. 23) or when X^{a)=l (where Zr{X^) and Xr{a) commute due to lemma 1). 

Comparison 4 (Multiple stabilizer hypergroups). The reason why we use multiple 
stabilizer hypergroups instead of merging them into a single commutative algebra 

is that Ending a basis with hypergroup structure for the latter object is not a simple 
task®. On the other hand, we can easily keep track and exploit the available hypergroup 
structures by simply storing a poly-size list of pairwise commuting stabilizer hypergroups. ^ 

“We have not investigated this problem nor whether a hypergroup basis can always be found. 

^’Throughout the paper r will always be poly-sized and all examples we give (section 5.3) have r < 2. 

The next two results imply that any intermediate quantum state of a hypergroup normal- 
izer circuit (section 4) computation is a hypergroup stabilizer state and, hence, can be 
characterized concisely as a joint-eigenstate of some commuting hypergroup Pauli opera¬ 
tors. This observation motivates our further development of these concepts. 

Claim 1 (Standard basis states). Conjugacy-class and character states (10) are in¬ 
stances of hypergroup stabilizer states stabilized by single stabilizer hypergroups. 

Theorem 3 (Evolution of stabilizer states.). Normalizer gates map hypergroup Pauli 
operators to new hypergroup Pauli operators under conjugation and, therefore, transform 
hypergroup stabilizer states into stabilizer states. It follows from this and the previous 
claim that the quantum state of a normalizer circuit is always a stabilizer state. 

Theorem 3 extends a theorem of Van den Nest [40] for abelian group stabilizer states. 

In order to prove claim 1, theorem 3, and many of the main results in the next sections, 
we will develop a new kind of hypergroup stabilizer formalism techniques that can cope 
with the non-monomiality and the non-unitarity of hypergronp Pauli operators. A 
central part of the paper will be dedicated exclusively to this end. We stress the necessity to 
develop such techniques since currently available stabilizer-formalism methods—including 
the PSF [37-39, 61-65], the Group Stabilizer Formalism [40-42, 36], the general Monomial 
Stabilizer Formalism of Van den Nest [59], and the recent XS stabilizer formalism [66]— 
can not be applied in our setting as they critically exploit the monomiality/unitarity of 
stabilizer operators for central tasks such as simulating Clifford/Normalizer operations, 
analyzing stabilizer state and code properties (e.g., code dimension, code support), and 
giving normal forms for stabilizer states^^. The lack of these beneficial properties requires 
a change of paradigm in our setting. 

To prove our claim 1, we will show a stronger result (theorem 4 below), which gives 
a normal form for hypergroup stabilizer states; we outline the proof of theorem 3 below, 
with details referred to appendix A. 

Proof of theorem 3, part I. We show that normalizer gates transform X- and Z-type Pauli 
operators over T into new Pauli operators (which may involve products of X, Z Paulis) 
under conjugation. This result extends to arbitrary products of these operators. (Compare 
to the abelian-group case [40].) 

^®The role of monomiality and unitarity in the PSF has been extensively discussed in [59]. 
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Specifically, for any invertible element s £ T, invertible character G T*, auto¬ 
morphism a, quadratic function we can calculate this action for the normalizer gates 
Z'j-{Xfj)X'T-{a), Ua, D^, and the hypergroup QFT: 


Xr{a) 

Zr(X,)Xr{s)^ r ^ 

-^ X^{a)Xr{a), 

ZrW 

^,(-s)ZrW, 

(23) 

Xr{a) 

Xr(a(a)), 

ZtW 


(24) 

Xr{a) 

-^ ?(a)^r(a)^r(/3(a)), 

Zrm 

Zt^, 

(25) 

Xr{a) 

> Zq-* (a), 

ZtW 


(26) 


When = 'Hji <8) • • • <8) y-Tm > the partial QFT over Ti simply transforms the fth tensor 
factor of the Pauli operators according to (26). In (25), /3 is a homomorphism from T 
to the subhypergroup of invertible characters that depends on Q in (24), a~* is the 
inverse of the dual automorphism a* [74]: 

Definition 2 (Dual automorphism [74]). The dual automorphism of a, denoted a*, is 
the automorphism of T* that takes to the character := X^ o a for fixed dQ.® 

“This is a morphism because (^)= {X^ o a) (X^ ° «) = {X~, oa) = Y,~, X^^^-^)- 

Proving (23-26) involves bulky yet beautifully structured hypergroup calculations that are 
carried out in appendix A. □ 

It is worth noting that normalizer gates transform Pauli operators over T into Pauli 
operators over T if they are not QFTs and into Pauli operators over T* otherwise^"^. 

5.3 A normal form for stabilizer states and examples 

In this final subsection we give examples and a normal form for a class of hypergroup 
states that generalize the well-known notion of Calderbank-Shor-Steane (CSS) stabilizer 
states [48-50]: 

Definition 3 (CSS stabilizer state). A hypergroup stabilizer state [V') over T is said 
of CSS type if it is uniquely stabilized by two mutually commuting stabilizer hypergroups 
5^^, consisting only of Z and X Pauli operators respectively. 

The standard definition of CSS state is recovered by setting T = Z 2 (cf. the example 
sections in [40, 41]). For the sake of brevity, we assume 5^^ and to be maximal 
mutually commuting hypergroups in this section^®. With these requirements, lemma 1 
imposes that 5^^, must be of the following form: 

5^“= = {Xr{a),a G A7}, A„(Ar(a)) = X,{a) 

= {Zr{X^),X^ G A7^}, \z{Zr{X^.)) = X^{s), (27) 

where s G T, T,; G T*, A7 < T is a subhypergroup, and N'^ is the annihilator of Af (6). 

We are now ready to prove the main technical result of this section, theorem 4, which 
characterizes the set of CSS stabilizer states and leads to specific examples. 

^^Recall from section 4 that the hypergroup label T keeps track of the basis in which basis (10) mea¬ 
surements are performed and indicates which Pauli operators are diagonal in each basis. 

^®This maximality assumption is not necessary in our derivation but it shortens the proofs. 
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Theorem 4 (Normal forms for CSS states), (a) The quantum states stabilized by 
from (27) are those in the subspace 

V 5 := spanjV'y, y G sJ\f} = spanj^j,, G X^N^], 

where 'ijjy and are functions supported on sM and X^M-^, respectively, and defined by 






(28) 


A state 1^/’) is uniquely stabilized by ,S^^} iff dim(V 5 ) = 1. (b) Furthermore, if either 
s or X(; is invertible, then stabilizes a unique state of form“ 


E 

x£sj\f 


'^sjV 


x^{x)\x), Xr\ik) = ^ 






(29) 


“Cf. section 2.2 for definitions of 


Theorem 4 is proven at the end of the section after mentioning a few main applications. 

We highlight that, despite our focus on stabilizer states, theorem 4 can be easily ex¬ 
tended to study hypergroup stabilizer codes. For instance, in case (b), we could choose a 
smaller stabilizer hypergroup = {X 7 -(a),a G JC} with /C C A/" to obtain an stabilizer 
code Vs, whose dimension is easy to compute with our techniques^®. Similarly, one could 
shrink 5^^ or both stabilizer hypergroups at the same time. 


Open question The hypergroup CSS code construction we outlined clearly mimics the 
standard qubit one [48-50, 88 ]. Interestingly, there could also be hypergroup CSS codes 
with no qubit/qudit analogue if there exist groups (or even hypergroups T that do not 
arise from groups) for which V 5 in theorem 4(a) can be degenerate. Though this is never 
the case for abelian groups because the Pauli operators in (27) generate a maximal lin. 
ind. set of commuting operators (with rank one common eigenprojectors), it can happen 
in our setting.We leave open the question of whether such codes exist. 


Examples and applications of theorem 4 

Theorem 4 is an important technical contribution of this work that will be used three 
times within the scope of the paper: firstly, in the examples below, to construct efficient 
classical descriptions for new kinds of complex many body states; secondly, in section 6 , 
to devise classical algorithms for simulating hypergroup normalizer circuits (theorems 5); 
and finally, in section 7, in the development of an efficient quantum algorithm for hidden 
subhypergroup problems (theorems 8-9). 

We now give examples of CSS hypergroup stabilizer states of the simpler form (29). 

Example 1: standard basis states We show now that conjugacy-class states and charac¬ 
ter states (10) are instances of hypergroup CSS states (of type (b)), as anticipated above 

^®With minor modifications of our proof of theorem 4, we get that the dimension is the nnmber of cosets 
of K. inside sW, if W is invertible, and the number of cosets of inside if s is invertible. 

^^Products of hypergroup Pauli operators in (27) can be linearly dependent (choose W = {±l,Ci} for 
the quaternion group, section 4) and their cardinality IWIIA/”^! may not match the dimension of Hq [83]. 
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(claim 1). Consider, first, an arbitrary \a) with a ^ T- Eq. (20) implies that IV') is sta¬ 
bilized by 5^^ = {Z'j-{X^), G T*} with maximal = T* and \z{Z'f{X^)) = X^{a). 
Letting , J\f, and be trivial, the state can written in the form given in theorem 4.(b) 
(note that A^; is an invertible character) and, hence, |o) is a uniquely stabilized CSS state. 
An almost identical argument, using (21) instead, shows that any character state \?iy) is 
uniquely stabilized by = {X 7 -(a),a G T} with \x{X-Y{a)) = Xy{a). (Note that in 
both cases equation (29) reproduces (10) consistently. ) 


Example 2: hypergroup coset states The states in example 1 are always product states. 
Yet theorem 4 also implies that highly entangled states such as the abelian group coset 
states that appear in the abelian HSP quantum algorithms [89], 


x + H) = Y, 

h&H 


1 

VW\ 


X + h), 


H \s a subgroup of a finite abelian group G, 


(30) 


as well as the abelian hypergroup coset states used in the quantum algorithm [46] , 


sM)=Y.J 

x£sM ’ 




AA is a subhypergroup of a finite abelian hypergroup T, (31) 


are all instances of CSS hypergroup states of type (a) with trivial uniquely stabilized 
by = {Xr{a),a G AA}, 5^" = {Zr(A),), A), G A/"-^}, Xz{Zr{X^)) = X^{s), and trivial, 
invertible Ax- 

In the special case of abelian group coset states (30), theorem 4 recovers a result by 
Van den Nest [40] who identified the latter to generalized abelian group stabilizer states. 
Theorem 4 extends the latter result demonstrating the existence of complex many-body 
states—hypergroup coset states (31) and more (28-29) —that can be described within 
the present Hypergroup Stabilizer Formalism but not within the standard PSF and its 
abelian-group extensions [37-41], or even (to the best of our knowledge^®) or within other 
generalizations of the PSF such as the Monomial Stabilizer Formalism [59] and the X-S 
Stabilizer Formalism [66]. 


Proof of theorem 4 

We finish this section by proving theorem 4 and giving a method for preparing coset states 
as a corollary (corollary 1). As announced in the previous section, the proof of this result 
relies on new technical ideas based on hypergroup methods, which are needed to handle 
the non-unitary, non-monomial stabilizers of theorem 4. 

Proof of theorem 4- First note that the properties discussed in section 5.1 show that both 
stabilizer hypergroups are well-defined. To prove the theorem, we will use some 

basic hypergroup theoretic results described in the following lemma. 

^®The authors are not aware of any method to express hypergroup coset states in terms of monomial 
unitary stabilizers as in [37-41, 59, 66]. We doubt such a description could exist and, at the same time, be 
easy to track under the action of hypergroup normalizer circuits as in theorem 3. 
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Lemma 2 ([82, 2.4.15,2.4.16]). For any subhypergroup A/", the hypergroup isomorphisms 
M* = T*/M-^ and (T /Af)* = (cf. section 2 . 2 ), can be canonically realized as follows. 

(i) All characters of Af are obtained via restriction of characters of T, and two characters 
£ T* act equally on Af if and only if Xa £ . 

(ii) All quotient characters are obtained by letting characters in Af-^ act on cosets xAf, 
and this map is well-defined because the former act constantly on the latter. 

Next, we identify necessary and sufficient conditions for the a state {if) to be uniquely 
stabilized by {S^ First, condition (22) says that |'0) is stabilized by iff 

Zr{X^)\'ijj) = X^{s)\^l;) = X^iZriX^))]^^) for every X^ £ Af-^. (32) 

Due to lemma 2(ii), this holds iff the wavefunction if is supported on a subset of the coset 
sAf. On the other hand, we show that \'if) is further stabilized by iff if belongs to the 
image of the following operator: 

Px ■■= ^ w^_j^±w^X^(b)Xr(b). (33) 

beJV 


The “only if” follows from the fact that X'f(b)\if) = X^(h) and the orthogonality relation¬ 
ship ( 8 ). The “if” follows from the calculation 


Xr{a)Px = Y. — - <,X^(b)Xr(c) =Y 

* ^ 777 . ^ ^ 


b,c&X 


Wx 


c&M 


Wx 


E 

ceA/" 




Wx 


X^(a)X^(c)Xr(c) = X,(a)Px, 


YnLX^(b)]Xric) (34) 

\beAf J 

(35) 


which implies with ( 8 ) that Px is a projector, and consequently, we get X-j-(a)\if) = 
Xr{a)Px\if) = X,;(a)Px\if) = X^(a)\if) as desired. 

As a result, we obtain that the stabilized states of are the quantum states 

in the vector space V 5 := span{Px|y) : y £ sAf}, where 


Px\y) = Y 


W x^Wi 


b&M 

xGsjV 



X^(b) |x). 


(36) 


and that \ip) is uniquely stabilized iff this space is one dimensional. The proof for the RHS 
of (28) is the same: due to duality, we can apply a QFT (26) and reach this equality by 
repeating the whole proof from the beginning with exchanged roles for T and T* ■ This 
proves case (a). 

Finally, we prove (b). First, in the simplest case, s = e, we can see that ify(x) = 
^/wfX^(xy) = y/wfX^(x)X^(y) = ifi(x)X^(y) by (3), since x,y £ Af and X^ is a character 
of Af. When x,y £ sAf, for s 7 ^ e, we can, in general, have n^y ^ 0 iov z ^ Af, so we 
cannot apply (3). However, when s is invertible (so ss = 1), we can get the same result as 
in the simplest case by a simple change of variables. 

For any x,y £ sAf, we define x' := sx and y' := sy. Since x'y' = sxys = ssxy = xy, 
we have n^,-, = n’j.y and, taking 6=1 and y = x, we have Wx' = Wx from the definition 
of Wx- As these are the only appearances of x and y in ify(x), this shows that ify(x) = 
ifyi{x'). This combined with the previous easy case (for x', y' £ Af), shows that all ify’s are 
proportional to the non-zero function ifi(x), which shows that the space is one-dimensional 
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and contains \^p). Finally, it is easily checked, in the case that is invertible, that the 
normalization constant in (29, LHS) is otherwise, it follows from (8). 

As in case (a), duality lets us repeat the argument to get (29, RHS). □ 

As a final remark, we highlight that theorem 4 introduces many new states that we 
are not aware to be preparable by standard or character basis inputs and normalizer gates 
(the ingredients of the computational model in section 4), in general. However, we point 
out that the CSS states of type theorem 4.(b) can always be prepared by measuring Pauli 
operators. 

Corollary 1 (Coset state preparations). Let C be a circuit takes the standard basis 
state \Xi) as input, performs (an inverse QFT) or Fq-*^ and then performs a syndrome 
measurement of the Pauli operators in a stabilizer hypergroup of form (27)“. Then C 
prepares a coset state. Specifically, it prepares \sM) with probability WsmI'^T- Further¬ 
more, if |a:o) is given, Fq- or JT]-* is applied, and (27) is measured, then the outcome 
is a coset state with probability 

“This is the canonical measurement defined by the common eigenprojectors that may be implemented, 
e.g., by measuring a poly-size set generating set of , which exists if there is one for A/”^ (section 5). 

All states of form (29) can further be prepared from a coset state by applying Pauli gates. 

Proof. If we prove the first case, the second holds due to hypergroup duality. Lemma 
2(ii) implies that measuring 5^^ is equivalent to performing a projective measurement 
with projectors {Psj\f = |sAA)(sAA|}. The claim follows by rewriting F^\Xi) = F'y*\Xi) = 

SaeT I“) = YjsN&T/N \Jff \^ 

6 Classical simulation of hypergroup normalizer circuits 

The Gottesman-Knill theorem shows that Clifford circuits can be efficiently simulated 
on a classical computer, as there is an efficient classical algorithm for sampling from the 
distribution of measurement outcomes of these circuits [37, 38]. This result was generalized 
by Van den Nest [40] and Bermejo-Vega [41] to normalizer circuits over all finite abelian 
groups, recovering the result of [37, 38] for T = IPf. 

The original GK theorem was surprising because the intermediate state of a Clifford 
circuit can be maximally entangled [90], demonstrating that entanglement by itself is not 
sufficient resource for exponential quantum speedup in the standard gate model. The gen¬ 
eralization of [40, 41] expanded the set of quantum circuits that can be classically simulated 
and added new insights about HSP quantum circuits, showing that highly sophisticated 
gates such as Quantum Fourier Transforms sometimes fail to exploit the entanglement 
present in the HSP coset states to provide a speed-up. 

Our next theorem extends a variant of the original Gottesman-Knill to normalizer 
circuits over arbitrary abelian hypergroups. 

Theorem 5 (Simulation). Let C be a normalizer circuit over a finite abelian hypergroup 
T containing global QFTs, automorphism gates, and Pauli gates (but no quadratic phase 
gates) followed by a final measurement in the standard basis (cf. section 4). Then, given 
certain computability assumptions about T and its characters (section 6.1), there exists 
an efficient classical algorithm for sampling the measurement outcomes of C. 
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The proof of the theorem is given at the end of the section. Our simulation result greatly 
expands the families of quantum circuits of [37-41] can be classically simulated and it also 
adds yet more evidence to support the idea that, for the HSP, quantum efficiency may go 
hand-in-hand with classical simulability. 

We highlight that our theorem generalizes the so-called CSS-preserving Gottesman- 
Knill theorem [60] without intermeadiate measurements, where the only normalizer gates 
allowed are those that send CSS states to CSS states (definition 3). Our result also extends 
the CSS-preserving case of the theorems in [40, 41], Yet, theorem 5 does not fully extend 
the ones in [37, 38, 40, 41], which altogether cover simulations of partial QFTs, quadratic 
phase gates, and intermediate Pauli-operators measurements interspersed along the circuit. 
Simulating these extended cases is much harder in our nonabelian setting because of the 
non-unitarity and non-monomiality of hypergroup Pauli operators (cf. discussion in section 
5), which do not let us apply any existing techniques for manipulating stabilizer codes [37- 
42, 36, 59, 61-65]; instead, the simulation method we give is based on the new hypergroup 
stabilizer techniques of section 5. 

We stress that CSS normalizer operations can be highly nontrivial, as the the quantum 
algorithms for abelian HSP are normalizer circuits with CSS structure. Theorem 5 could be 
used to simulate such circuits gate-by-gate if the information about the hidden subgroups 
was not manifestly hidden and groups were presented in a factorized form (cf. [36] for 
an extended discussion). This means, for instance, that the entanglement present in a 
CSS-preserving circuit can be quite substantial. 

Lastly, we conjecture that our simulation result can be extended to all normalizer gates 
despite the non-monomiality / non-unitarity issues we discuss. 

Conjecture 1 (Conjecture). There exist nontrivial families of abelian hypergroups for 
which the normalizer circuits of theorem 5 can still be efficiently classically simulated if 
they are supplemented with partial QFTs and quadratic phase gates acting at arbitrary 
circuit locations. 

Discussion: extensions of theorem 5 

In the light of our conjecture, we mention a few simpler extensions of theorem 5 that 
we are aware of. 

First, note that an efficient classical simulation is still possible if the main circuit 
is followed by another one C' that contains any monomial normalizer gate (including 
quadratic-phase gates), which is then followed by a measurement in the standard ba¬ 
sis^®: such circuits can prepare more types of entangled stabilizer states like (17) and the 
quaternionic cluster state (section 4.2). 

Second, the theorem can be easily extended to allow arbitrary CSS state / stabilizer 
state inputs with one further minimal assumption, namely, that their corresponding wave- 
functions can be sampled both in the hypergroup element basis B 7 - and in the character 
basis B 7 -*, which lets us, in particular, simulate QFTs acting on the state (see section 6.1, 
condition (ii) and section 6 . 2 ). Furthermore, if this holds for the simple CSS states of 
theorem 4, then theorem 5 can be extended to circuits that can, e.g., prepare coset states 
as in corollary 1 and/or accept coset states as inputs. 

6.1 Computability assumptions on hypergroups 

In theorem 5, we must restrict ourselves to hypergroups with sufficient structure to let us 
efficiently compute within them and their character hypergroups. Note that assumptions 

^®One can simply absorb those gates in the measurements [91]. 
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of this kind are typically made in the HSP literature: for instance, in order for the HRT 
quantum algorithm for the HNSP [12] to be efficient one needs to be given the ability 
to intersect characters kernels. The assumptions needed for theorem 5 are listed next, 
followed by examples of hypergroups that meet them. 

First, in theorem 5 we assume that the hypergroup T as well as its dual T* are effi¬ 
ciently computable: we say that a hypergroup T is efficiently computable^^ if its elements 
can be uniquely represented with n = 0(polylog|T|) bits and there are 0(poly(n))-time 
classical subroutines to perform the hypergroup multiplication, i.e., given two elements Xj, 
Xj G T and an index fc, we can efficiently compute the coefficient for any i,j, k. 

In theorem 5, we further need to assume that the involved hypergroups are what 
we call doubly efficiently computable: a hypergroup T is doubly efficiently computable if 
both T and T* are efficiently computable and, furthermore, that the structure of their 
associated character tables is sufficiently well-known that we are able to efficiently perform 
the following tasks classically: 

(i) Computable characters. For any a G T, any character function X^{a) can be 
efficiently computed classically^^. 

(ii) Simulable input states. Quantum Fourier transforms of allowed input states can 

be efficiently sampled classically, or equivalently, the distributions {pa} and {q^}, 
with Pa := for fixed G T* and := for fixed a eT, 

can be efficiently sampled. 

(hi) Computable dual morphisms. For any efficiently computable hypergroup au¬ 
tomorphism a : 7” —T, its inverse a~^ and its dual automorphism (definition 2) 
a* : T ^ T* : X ^ fx^ can both be efficiently determined and computed. Duals of 
computable hypergroup homomorphisms f : T T' can also be computed^^. 

Examples and remarks Both computability notions presented are preserved by taking 
direct products 7i x Ti. Furthermore, the notion of doubly efficiently computable hyper¬ 
group is preserved under taking duals T GG T*. 

Any hypergroup of the form 71 x • • • x Tm is doubly efficiently computable if homo¬ 
morphisms are restricted to be of a product form /i x • • • x fm, where m is constant, or if 
they act nontrivially only in a constant number of sites. As a result, normalizer circuits 
over hypergroups of the from 71 x • • • x Tin with constant |71| will always turn out to be 
efficiently simulable if they contain at most /c-local entangling gates, for any constant k 
(theorem 5). The examples given in section 4.2 over the quaternions were of this form. 

As another example, for any finite abelian group G, all problems in (i-ii-iii) can be 
solved in 0(polylog |G|) time given that G is explicitly given in the form G = ZjVi x • • • x 
Zjv„,. Condition (ii) holds for any abelian group stabilizer state with known stabilizer 
group. These results are invariant of the bit-size of any Ni [40, 41]. 

For arbitrary finite abelian hypergroups hnding simple bounds like those in [40, 41] is 
likely to be an “impossible” problem, since the question cannot even be addressed without 
classifying all conjugacy class and character hypergroups of all finite groups, whereas classi¬ 
fying the latter is regarded as a wild [93, 94] problem. It is easier to prove polynomial-time 
bounds for particular hypergroup/group families that fulfill the minimal computability re¬ 
quirements (i-ii-ii), like in the two examples given above. 

^^Efficiently computable hypergroups generalize the black-box groups [92] explored in [36]. 

^^For simplicity, we will assume that this can be done with perfect precision in this manuscript. It is 
straightforward to adapt our main results any degree of available accuracy. 

Applying def. 2 to a homomorphism f : T ^ T' one gets a dual morphism f*:T'^T [74, 1.6.(ii)]. 
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Finally, we highlight that there exist efficiently computable hypergroups that are not 
doubly efficiently computable unless there exist efficient classical algorithms for believed- 
to-be-hard problems like computing discrete-logarithms exist (see appendix C). In the 
abelian group case, the associated normalizer circuits can realize Shor’s [1] algorithms 
[36] and lead exponential quantum speed-ups. In section 7, we will develop new quantum 
algorithms based on normalizer circuits over such “black-box” hypergroups. 

6.2 Proof of theorem 5 

We finish this section proving theorem 5 by giving an explicit classical algorithm for 
sampling the outcome distribution after measuring the hnal state of the computation 
Cltpo), being |^o) the input state. Our algorithm is efficient given that the hypergroup T 
is doubly efficiently computable (section 6.1). The key technique that we exploit in our 
simulation is a normal formal for CSS normalizer circuits. 

Lemma 3 (Normal form.). Let C be a normalizer circuit over a T as in theorem 5. 
Then, C can be put in a layered normal form C = MF, where F is either trivial or a QFT 
and M is a monomial circuit® of automorphism gates and Pauli gates. Furthermore, if T 
is doubly efficiently computable, then M and F can be computed classically efficiently. 

“That is, a circuit whose transformation in matrix form has one entry per row and column. 

Proof of lemma 3. First, note that the Pauli gates in the circuit (which are of the form 
Xr{C), Zj-{X) in the conjugacy-class basis and of the form (C), in the char¬ 

acter basis) can be conjugated with all the other normalizer gates using the update rules 
in theorem 3(24,25). As a result, if t/ is a Pauli gate at an intermediate circuit position 
C = C 2 UC 1 , it can be removed from its location by adding a new Pauli-correction term 
U' = C 2 UC 2 at the start of the circuit. By doing this, we put C in an intermediate two¬ 
layered normal form C = PC', where P is a circuit of Pauli gates and C collects all QFTs 
and all automorphism gates that were present in C, in the same temporal order. 

We finish the proof of the lemma by showing that C can be put in a normal form AS 
where S is either the identity gate or a QFT, and A is a circuit of automorphism gates. 
Once we have that, we can combine P and A into a single layer M and obtain C = MS. 

To this end, we use that group automorphism gates can be conjugated with Fourier 
transforms in an elegant way, by replacing them with dual automorphism gates. Specif¬ 
ically, we have Fq-Ua = = Ua-*F'j- and F'j-*Ua-* = UaF-p*, where a~* is the 

dual of a~^ (definition 2). This follows by simple calculation, using (10) and the fact that 
automorphisms cannot change the weights of elements. Furthermore, we in fact have 


asT 6eT 

Hence, it follows that Ua = Pq-* as gates, which means that can implement the latter 
since we can implement the former by assumption. 

Applying these rules, we can move the QFTs before the automorphisms. Furthermore, 
since the effect of each QFT is just to change the designated of the circuit, any product of 
QFTs is equivalent to a single QFT gate, F, that changes the basis once (or not at all). 
By this proces, we get C = AF, where A is a product of automorphism gates. 

Finally, the assumption that both T and F* are efficiently computable (and, hence, so 
is any hypergroup of form in (13)) means that we can efficiently compute the conjugations 
to determine the gates in P using (24, 25). The assumption that T is doubly efficiently 


Wi,W^ 


*(m) 


VJ'j' 


— Uqi-* 
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computable also includes the assumption that we can find a~* efficiently for any a, so we 
can compute the automorphisms in A efficiently as well. We can determine F at the same 
time with no additional assumptions, so we can see that M and F from the statement of 
the lemma can be determined efficiently under our assumption on F. □ 

To prove the theorem, we first apply lemma 3 to put C in normal form, MF. Next, 
we note that M acts as M\a) = 7 a|vr(a)), where 7 a has unit modulus and tt is some 
permutation on the elements of the basis for the image of F. Thus, measuring in the final 
basis, after applying M, is equivalent to measuring in the basis after F and then applying 
TT, which consists of just the automorphisms and Pauli X-gates from M. 

The assumption that T is doubly efficiently computable (section 6.1) tells us that all 
of this can be done efficiently. We can compute M and F under these assumptions by 
lemma 3. We can simulate a measurement after applying F by assumption (ii). Then we 
can compute the result of each automorphism and Pauli X-gates from M by assumption 
(i) and the assumption that F and F* are efficiently computable, respectively. Q.E.D. 

Remark As mentioned in the discussion after theorem 5, one can straightforwardly extend 
this simulation method to any input I'lpo) if measurements on \iPq) on the hypergroup 
element and character bases are easy to simulate (because we only use that information 
about the state). 

7 Quantum algorithms for HNSP and abelian HSHP 

In this last section, we apply the hypergroup methods of previous sections to the develop¬ 
ment new quantum algorithms for the HNSP and for the CC-HSHP. 

We give three quantum algorithms for the HNSP of increasing generality (and com¬ 
plexity). These algorithms are interesting because they are fundamentally different from 
the one of Hallgren et al. [12], as they exploit the hypergroup structure of the HNSP: to 
solve the problem, we turn it into it into a CC-HSHP (using theorems 1-2, section 3) and 
solve the resulting abelian HSHP instead. Our results show that, in the cases considered 
here, the HNSP is easy because the CC-HSHP is easy, which gives an explanation for why 
the HNSP is easy in terms of the presence of an abelian algebraic structure. 

Our quantum algorithms for the CC-HSHP are interesting in their own right (beyond 
their use in solving the HNSP) as no provably efficient algorithms were previously known. 

As we will see shortly, all of the quantum algorithms we consider here fit within our 
normalizer circuit model. This means that they can be analyzed using the stabilizer 
formalism of section 5. The results of that section, especially theorem 4, will be critical 
to all of our analysis below. 

We begin in section 7.1 by looking at a previously proposed algorithm for the HSHP 
[47]. We show that, in one subclass of cases, not only can we reduce the HNSP to the CC- 
HSHP (as we saw in section 3), but in fact, the algorithm of [12] for the HNSP is identical, 
under a simple vector space isomorphism, to the proposed algorithm of [47] applied to 
the CC-HSHP. This demonstrates an even deeper connection between the HNSP and the 
CC-HSHP than that demonstrated by the reductions of section 3. 

In section 7.2, we use our stabilizer formalism to analyze the proposed algorithm of 
[47]. We describe instances where it does and does not work correctly. This analysis leads 
us to a new algorithm, described in the same section, which works correctly for all groups. 

In section 7.3, we develop new qnantum algorithms, taking advantage of the unique 
structure of abelian hypergroups. The resulting algorithms work for all nilpotent (hy- 
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per) groups (along with some non-nilpotent groups) and requires fewer assumptions than 
those of section 7.2. As with the algorithms of section 7.2, the stabilizer formalism remains 
key to our analysis. 

Finally, in section 7.4, we mention a few further results and some open problems. 

7.1 A comparison of two simple algorithms for the HNSP 

To illustrate ideas we use later and introduce the quantum algorithm proposed in [47] 
for the CC-HSHP, we begin by discussing it and comparing it to the standard algorithm 
for the HNSP [12] in the case when the oracle / : G —>■ {0,1}* is a class function. This 
happens if and only if G/N is abelian, where N is the hidden normal subgroup. We show 
that, for this case, the two algorithms actually coincide: the HNSP becomes an instance 
of the CC-HSHP and the same algorithm solves both problems. 

As we saw in section 3, such an / is easily transformed into an oracle / : G —)• {0,1}* 
for the CC-HSHP since each coset xN is in a conjugacy class by itself. This allows us to 
turn algorithms for the CC-HSHP into algorithms for the HNSP (and vice versa). We now 
compare two algorithms designed for this common problem via two different perspectives. 

The quantum algorithm of Hallgren, Russell, and Ta-Shma for HNSP [12], henceforth 
referred to as “HRT”, operates as follow: 

1. Initialize a workspace register in a quantum state |xi)- 

2. Apply an inverse QFT in order to obtain a superposition Id)- 

3. Evaluate the oracle on an ancillary register to obtain Ylgld^ fid)) ■ Measure the 
second register to project the state of the first onto a coset state \xN), for some x 
drawn uniformly at random. 

4. Apply a QFT to \xN) and measure the label ^ of an irreducible representation. 

5. Repeat the experiment T times and record the outcomes , ht- 

6. Determine the subgroup fj^kery^.. With exponentially high probability 1 — O(^), 
the subgroup f)• ker is the hidden subgroup N. 

The quantum part of this algorithm (steps 1-5) can be implemented efficiently if we have 
an efficient implementation of the QFT. However, the complexity of the classical post¬ 
processing (step 6) is unknown, in general. 

The quantum algorithm of Amini, Kalantar, and Roozbehani applies to the hidden 
subhypergroup problem (HSHP). When applied to the conjugacy class hypergroup, G, we 
refer to this algorithm as “AKR”. It takes as input an oracle / : G —)> {0,1}* and operates 
as follows: 

1. Initialize a workspace register in a quantum state \Xi). 

2. Apply an inverse QFT in order to obtain a superposition |G|“^/^ Yhcx&G yJ'^Cj,\Cx)- 

3. Evaluate the oracle on an ancillary register to obtain |G|“^/^ f{Cx))- 

Measure the second register to project the state of the first onto a hypergroup coset 
state \CxNg), for some x drawn uniformly at random. 

^^Note that we are working in the Hilbert space with basis {\Cx) \ Cx £ G} and the state \CxNg) is a 
superposition of those conjugacy classes that make up CxNc- 
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4. Apply a QFT to the state \CxNq) and measure the label of a character. 

5. Repeat the experiment T times and record the outcomes X^^, ..., X^^. 

6. Determine the subhypergroup of classes in the kernels of all the X^^s. 

Like HRT, steps 1-5 can be implemented efficiently while the complexity of step 6 is 
unknown, in general. 

As the reader can see, the two algorithms perform the same steps. First, they apply an 
inverse Fourier transform to prepare a superposition over the entire basis on which they 
operate. Next, they apply their respective oracles to an additional register, measure, and 
throw away its value. Finally, they apply a Fourier transform and measure in the new 
basis. For AKR, this is measuring a character label, while for HRT, this is measuring the 
label of an irrep. It is critical to note that HRT does not use the value of the matrix index 
register, which is part of the output of the QFT for the group. 

When / is a class function (so that G/N \s abelian), we have CxNq = xN since each 
coset xN is in its own conjugacy class. Hence, we can see that the two algorithms are in 
matching states after steps 1-3. In particular, the state of HRT after step 3 is conjugation 
invariant, and since the QFT preserves conjugation invariance, so is the state of HRT after 
step 4. In fact, it is easy to check that the QFT of G applied to the conjugation invariant 
subspace is exactly the QFT of G. More precisely, we have the following result, which is 
also easy to check. 

Proposition 1 (HRT = AKR). If / : G —>■ {0,1}* is a class function, then HRT operates 
entirely within the conjugation invariant subspace T-Lq- Furthermore, within this subspace, 
HRT is identical to AKR. 

The first part of the following lemma simplify our analysis of the algorithm. (And the 
second part will be useful to us later on.) 

Lemma 4 ([73]). For any normal subgroups N, K such that N < A ^ G, the hypergroup 
G/Ng is isomorphic to G/N (the class hypergroup of G/N) and Kq/Nq is a subhyper¬ 
group of G/Nq isomorphic to K/Nq^j^ (which is a subhypergroup of G/N). 

Since G/N \s abelian, the quotient hypergroup G/Nq = G/N is actually a group. Hence, 
it follows immediately from the standard results on Fourier sampling of abelian groups [2] 
that both algorithms are correct in this case as they are actually just performing Fourier 
sampling of an abelian group. 

Theorem 6 (CC-HSHP is easy, I). Let G be a group. Suppose that we are given a 
function / : G —)■ {0,1}* hiding the subhypergroup corresponding to a normal subgroup 
A <1 G such that G/N is abelian, and suppose that we can efficiently compute the QFT 
for G. Then there is an efficient quantum algorithm for the CC-HSHP. 

As a corollary of theorem 6, we can see that there is an efficient hypergroup-based 
algorithm for solving HNSP in the case when the oracle / : G —>■ {0,1}* is a class function. 

Corollary 2 (HNSP is easy, I). Let G be a group. Suppose that we are given a hiding 
function / : G —?■ {0,1}* that is a also class function. If we can efficiently compute the 
QFT for G and compute efficiently with conjugacy classes of G, then we can efficiently 
solve this HNSP. 

Proof. This follows since we can efficiently reduce the HNSP to a CC-HSHP by theorem 
1, we can use the QFT of G to implement the QFT of G as described in appendix D, and 
we can solve this CC-HSHP efficiently by theorem 6. □ 
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7.2 Analysis of the algorithm of Amini et al. 

In this subsection, we analyze the AKR algorithm in more detail. Our analysis will benefit 
from our hypergroup stabilizer formalism tools (section 5), namely, our normal forms 
in theorem 4, which will let us characterize the outcome probability distribution of the 
quantum algorithm.This is possible due to the following connection with our normalizer 
circuit framework. 

Theorem 7 (AKR is normalizer). For any finite group G, the AKR quantum algorithm 
for the CC-HSHP over G is a normalizer circuit with intermediate Pauli measurements. 
Furthermore, all of its intermediate quantum states are CSS stabilizer states of form (29).“ 

“Although we do not discuss the full AKR algorithm, this theorem also holds for all abelian hypergroups. 

Proof. Steps 1-3 implement a coset state preparation scheme as in corollary 1, using the 
oracle as a black box to perform a syndrome measurement of type (cf. the proofs of 
corollary 1, theorem 4 for details). Step 4 takes the QFT of a coset state of form (29). □ 

Using this connection, we can apply the tools developed in the previous sections to compute 
the probability of measuring a given character label at step 5. 

The mixed state of AKR after the oracle is called and its value discarded is given by 

C^Ng&G/Ng 

since the probability of measuring each coset CxNq is proportional to its weight.Each 
coset state \CxNg) is a stabilized by X-Q^Cy) for any Cy G Nq and any Zg(A’^) for any 

G Nq, which means that it is a CSS stabilizer state of the form shown in equation 
(27) with s = Cx and = Xj, the trivial character. Thus, we can read off the Fourier 
transform of this state directly from theorem 4. 

Our application of theorem 4 is greatly simplified by the fact that X^ is the trivial 
character Xi. This means that = 1 since the weight of a character is the dimension 

of the underlying representation This means that the state {ip) for s = Cx and 

J\f = Ng is proportional to YliGy&CxNG '''^tiich is proportional to \CxNg)-, and 

thus, we have IV') = \CxNg) since both states are normalized. Thus, theorem 4 tells us 

X^\CxNg)= Y. 

XyCNa V 

^“^This is a new result. No formula for this probability was given in [46, 47]. 

^®The initial superposition has probability of measuring Cx proportional to wcx , so the probability of 
measuring the coset CxNg, which contains all the elements with the same value from the oracle as Cx, is 
proportional sum of all of their weights, Wq These sums are proportional to the weights so 

we get the form in the equation above after normalizing the probabilities to sum to 1. 

^®Note that X;Ng is an element of G/Nq — Nq (section 2.2), so this is the weight of viewed as a 
character of Ng, where it remains trivial. 
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and hence, the Fourier transform of the mixed state of AKR is 
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where, in the last step, we have used the fact that Nq = {G/NqY . Finally, using lemma 
4, we conclude that the probability of measuring the outcome is 


Pr(A^) = w^ 


'^CxNg 


X^iC,)Xf,{C,) = w, 
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(37) 


This formula is the key to our analysis of AKR in this section and the next. 

7.2.1 Non-convergence of AKR for simple instances 

We begin examining these probabilities by looking at an example. 


Example 1 (AKR Counterexample) . The Heisenberg group over Zp (with p prime) is 
the set Zp with multiplication defined by (x, y, z) ■ {x', y', z') = (x -|- x', y -1- y', z + z' + xy'). 
For a nice review of it’s representation theory, see the article of Bacon [95]. 

The center of this group is the normal subgroup Z{G) = {(0,0, z) | z G Zp}. Hence, 
any element of Z{G) is in a conjugacy class of its own. For any {x,y,z) 0 Z{G) (i.e., 
with {x,y) / (0,0)), it is easy to check that its conjugacy class is the coset {x,y,z)Z{G). 
Hence, the weight of the former classes are 1 and those of the latter are |Z(G)| = p. 

Let us consider the case when the hidden subgroup is trivial N = {e}. For any 
(a, b) / (0,0) there is a 1-dimensional irrep of the Heisenberg group, which we denote Xa^ 
given by Xa^b{x, y, z) = , where Up is a p-th root of unity. We can apply equation (37) 

to compute the probability of measuring this irrep in AKR. To do this, we first note that 
this probability would be the inner product of Xp with itself except that weights have been 
squared. Since there are only two sizes of conjugacy classes, it is not difficult to rewrite 
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this expression in terms of that inner product as follows. 
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p — P + P 


where we have used the fact that \Xa,b{x, y,z)\ = 1 for all x,y,z £ Zp. 
Finally, the probability of measuring any of the 1-dimensional irreps is 


^ PT{Xa,b) = ip^ 

{a,b)^{0,0) 



-p^ +P 

p6 


p'^ 


+p'^ +p^ — p 

p6 


= 1-0 



This means that if p is exponentially large, we are unlikely to ever see an irrep other than 
the Xa^bS, and since Z{G) is in the kernel of all such irreps, the intersection of the kernels 
of polynomially many irreps will include Z{G) with high probability. 

Since the AKR algorithm returns the intersection of the kernels of the sampled irreps 
as its guess of the hidden subgroup, this demonstrates that the AKR algorithm will fail to 
find the hidden subgroup with high probability for the Heisenberg group with N = {e}. 
Indeed, this shows that AKR will fail to distinguish between N = Z{G) and N = {e}, 
despite the fact that the former is exponentially larger than the latter. 


The probability distribution over irreps established by AKR in this example (and many 
others) favors the small dimensional irreps, whereas the distribution established by HRT 
favors the large dimensional irreps. In this example, that fact prevents AKR from ever 
seeing the irreps needed to uniquely determine N. (Paradoxically, when finding non¬ 
normal hidden subgroups, it is often the small irreps that are most useful and HRT that 
struggles to find them.^’^) 


7.2.2 An application of AKR: a 2nd hypergroup algorithm for the HNSP 

While AKR may fail to uniquely determine N from its samples, the following lemma tells 
us that it will, with high probability, learn something about N. 

Lemma 5. If 7 ^ G, then the intersection K of the kernels of the irreps sampled by 
AKR is a strict subgroup of G — i.e., we will have N < K < G — with high probability. 

Proof. The intersection of the kernels will be smaller than G provided that at least one of 
the samples has a kernel smaller than G. In other words, the intersection will be a strict 
subgroup provided that at least one of the irreps sampled is not the trivial irrep. 

We can use eq. (37) to calculate the probability of sampling the trivial irrep. Since 
Xi{Gx) = 1 for any Gx, the probability for the trivial irrep is just Ylc nOPJn 

^^While the AKR distribution would be better, AKR does not apply to finding non-normal hidden 
subgroups since the hypergroup structure is no longer present. 
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If we let G' denote the group G/N, then we can also write this as 
our job is to determine how close this can be to 1. 

Let Cl,... ,Cm be the conjugacy classes of G', and define Si = WcJt^q' = |Ci|/|G'|. 
The Sj’s satisfy ^ (since every element of G' is in some conjugacy class). Since 

the size of a conjugacy class divides the size of the group, we also know that Si < 1/2 for 
every i. Forgetting everything but these constraints, we can upper bound the probability 
of sampling the trivial irrep by the solution of the optimization problem 

maximize s? 

i 

subject to Si = 1 

i 

Si for i = 1.. .m 

The latter problem can be solved by ordinary methods of calculus. In particular, it is easy 
to check that the objective is increased if Si and Sj are replaced by Sj + e and Sj — e provided 
that Si > Sj. (I.e., the derivative in this direction is positive.) Hence, the objective will 
be maximized when the two largest Sj’s have value 1/2 and all other Sj’s are 0. At that 
point, the objective is (1/2)^ + (1/2)^ = 1/2. 

This tells us that the probability of sampling the Ai is at most 1/2 on each trial. 
Hence, the probability that all the samples are the trivial irrep is exponentially small. □ 

This lemma tells us that AKR will find, with high probability, a strict subgroup K < G 
such that N < K. This means that we can reduce the problem of finding N hidden in G 
to the problem of finding N hidden in K, which is a strictly smaller group. Provided that 
we understand the representation theory of K as well and, in particular, have a QFT for 
it, then we can recursively solve this problem. In more detail, we have: 

Theorem 8 (CC-HSHP is Easy, II). Let G be a group and N a normal subgroup. 
Suppose that, for each normal subgroup K satisfying N < K < G, we have a function 
: K —)• Hk that hides Nk-°' If we can efficiently compute the QFT for each such K, 
then there is an efficient quantum algorithm for the CC-HSHP. 

“Alternatively, we may assume that, for any K <1 G, we have a function that hides {N n K)j^. 

As a corollary, we can see that there is an efficient hypergroup-based algorithm for solving 
HNSP in the case when the oracle / : G —?• H is a group homomorphism. 

Corollary 3 (HNSP is easy, II). Let G be a group. Suppose that we are given a 
hiding function / : G —)■ H for N < G that is also a group homomorphism. If we can 
efficiently compute the QFT for any normal subgroup K satisfying N < K < G and 
compute efficiently with conjugacy classes of each such K and Hk, where Hk is the image 
of f\K, then we can efficiently solve this HNSP. 

Proof. The restriction of / to K, /{k ■ K —)• Hk, is itself a group homomorphism, so 
by the assumptions of the corollary and theorem 2, we can efficiently compute from it a 
CC-HSHP oracle f k • K —)• Hk. Hence, the result follows from theorem 8 and the results 
of appendix D on implementing the QFT of a hypergroup with the QFT of the group. □ 

In comparison to HRT, we have replaced the assumption about intersecting kernels of 
irreps with assumptions about computing QFTs over normal subgroups of G. Since the 
complexity of computing intersections of subgroups is unknown (at least in the black¬ 
box setting), the latter assumptions may be more reasonable in many cases. This same 
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approach of recursion on subgroups can also be used to give a variant of HRT with similar 
assumptions to those above. 

In this section and the previous, we have shown that, in cases when we can convert an 
oracle for the HNSP into an oracle for the CC-HSHP — either because the two types of 
oracles are actually the same or because we have sufficient information about the output 
of the former oracle to compute with their conjugacy classes — we can solve the HNSP 
by reducing it to CC-HNSP. That the latter problem can be solved efficiently depends 
crucially on the fact that the hypergroup is abelian. Thus, the results of the last two 
sections give us an explanation for why the HNSP is easy in terms of the presence of an 
abelian algebraic structure, the abelian hypergroup of conjugacy classes. 


7.3 Efficient quantum algorithm for the nilpotent group HNSP and CC-HSHP 

In this section, we describe our most unique hypergroup-based quantum algorithms that 
solves the HNSP and the CC-HSHP. Unlike the algorithm of the previous sections, this 
algorithm does not require any extra assumptions about subgroups such as hiding func¬ 
tions for them or the ability to compute efficiently with their conjugacy classes. More 
importantly, this algorithm is fundamentally different from the known algorithm (HRT), 
showing that this import problem can be solved efficiently using a different approach. 

Our approach takes advantage of unique properties of hypergroups. In particular, as 
we are looking to reduce our problem on G to a subproblem, we note that, for any normal 
subgroup K < G, there are actually two smaller hypergroups associated to it. The first is 
the hypergroup K that we get by looking at R' as a group separate from G. The second 
is the subhypergroup Kq, where Kq contains the conjugacy classes Gx & G such that 
X £ K. Above, when we recursively solved a problem in K, we were using the hypergroup 
K. However, as we will see in this section, it is also possible to solve the subproblem on 
the subhypergroup Kq < G. 

The subhypergroup Kq has two advantages over K. The first is that a CC-HSHP 
oracle for G is also a CC-HSHP oracle for Kq'- since the conjugacy classes of the two 
hypergroups are the same, the condition that the oracle is constant on conjugacy classes 
of G means that the same is true for Kq. The second advantage of this subhypergroup is 
given in the following lemma. 

Lemma 6 (Subhypergroup QFT). Let K <\G. If we can efficiently compute J-q, the 
QFT over G, then we can also efficiently compute i-e., the QFT over Kq. 


Proof. In fact, the QFT for Kq is implemented by the same QFT as for G provided that 
we choose the appropriate basis for the dual of Kq. 

To describe this basis, we first note that every character on G is a character on Kq 
simply by restricting its domain to Kq. This map of G —)• Kq is in fact surjective with 
kernel Kq [82]. This means that the characters oi Kq are in 1-to-l correspondence with 
the cosets of Kq in G (i.e., K*q ~ G/Kq), so our basis for characters of Kq should be a 
basis of cosets of Kq in G. As described in the example of section 5.3, the cosets of Kq are 
of the form \X^Kg) = = 

xyafP^Gl'^Kai using the definitions in section 2. This 
means that we can write the state instead as 


\X.Kq) = 


E 


I A', 




M/’ 
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which is the definition we will use below. 

With that basis chosen, we can now calculate the Fourier transform of a conjugacy 
class state \Cx) with Cx G Kq- The key fact we will use below is that Xfj,{Cx) = Xjj{Cx) 
whenever G X^Kq since they differ only by multiplication with a character that is 
identity on Cx (lemma 2.(i)). Hence, we can define X^Kq^Cx) to be this common value. 


-TdC.) = 


^ ^,X^{Cx)\X^) 


Wc. 

Wq 


Y, X^K^iCx) Y 




X^Kc&GIKa 




Wq 


X,Ka{Cx)J^^ -IT.W 
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Y y/<^XuKt{Cx)\X,Kt) 


® X^Ka&G/Ka 


Because K*q = G/Kq and this last line is, by definition, the QFT for Kq, 

so we have seen that the QFT for G implements this QFT as well. □ 


The lemma shows that the assumption that we have an efficient QFT for the whole hy¬ 
pergroup G is sufficient to allow us to recurse on a subproblem on Kg without having to 
assume the existence of another efficient QFT specifically for the subproblem, as occurred 
in our last algorithm. 

Our next task is to analyze the AKR algorithm applied to this hypergroup and, in 
particular, determine the probability distribution that we will see on character cosets 
when we measure. Recall that the algorithm starts by preparing a weighted superposition 
over Kg (which is a uniform distribution over K) and invoking the oracle. The result is 

P= Y \CxNg){CxNgV 

GJ^gGKg/Kg) ’^^^gIKg) 


As with AKR, we can find the Fourier transform of this state directly from theorem 4. 
Following the same argument as before, we see that the |'i/’) from part (b) with X^ = X^, 
the trivial character, and s = Ca; is precisely the state \CxNg)- Note that, since we are no 
longer working in G but the subhypergroup Kg, we do a QFT over Kg (lemma 6) and 
the subhypergroup = Nq in theorem 4 belongs to K*g. 


J^kJC.No) = E 






MCx)\Xf 


M/) 


By a similar calculation to before, we have 




w 


''f^X^{Cx)Xp{Cx)\X^){X, 


w: 




G^NgGKg/Ng) 
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Finally, using Nq = {Kg/NgT — (^/^g/nT (lemma 4), we conclude that the probabil¬ 
ity of measuring G is 

— _ 

Pr(d:'^) = X^{C,)X,{C^) 

C^NaeiKa/No) 

1^2 _ 

= ^ (38) 

C^m^(kJNo/n) 

which is analogous to what we saw in equation (37). 

With this in hand, we can now prove the following result. 

Lemma 7 (HSHP over p-groups). Let G be a p-group, for some prime p. Suppose 
that we are given a hiding function /:G—7-{0,l}*. If we can efficiently compute the QFT 
for G and we can efficiently compute the kernels of irreps when restricted to subgroups, 
then there is an efficient quantum algorithm for the CC-HSHP. 

Proof. We follow a similar approach to before, applying AKR to subhypergroups Kg 
(starting with K = G) until we measure an irrep u with kernel smaller than K and then 
recursing on Jg < Kg, where J = ker(i/|/f). By assumption, we can compute ker(z^|ii') 
efficiently. If we fail to find such a in polynomially many samples, then we can conclude 
that K is the hidden subgroup with high probability. 

By lemma 6 and the notes above it, our assumptions imply that we have an oracle and 
an efficient QFT for each subproblem. To implement AKR, we also need the ability to 
prepare a uniform superposition over K. This was implemented earlier using the inverse 
Fourier transform. In this case, that would require us to prepare a complicated coset state 
in G. However, we can instead just prepare the superposition directly by the result of 
Watrous [96].^® 

Finally, it remains to prove that we have a good probability (e.g., at least 1/2) of 
measuring a nontrivial irrep or, equivalently, that the probability of measuring the trivial 
irrep is not too large (e.g., at most 1/2). As before, this amounts to putting a bound on 
Ec,jv 6 (i 777 Vg/^)(^c,^/roK 7 jVc/^)^, this time by equation (38). By the same argument as 
before, this will hold if we can show that Wc^nqI'^kTn is bounded by a constant less than 
1. Earlier, we showed this by using the fact that the size of a conjugacy class divides the 
size of the group. Unfortunately, that does not help us here because we are comparing 
'^c^nq = \Cxn\ not to the size oi G/N but to the size of the subgroup K/N. These two 
need not be related by even a constant factor. In extreme cases, K/N may contain only 
one group element that is not in GxN [97]. 

Instead, we will use properties of p groups. Since G is a p-group, so is K/N, and the 
size of K/N must be p^ for some k. Since the size of a conjugacy class divides the size 
of a group (this time G/N), the size of CxN in K/N must be p^ for some j. Now, we 
must have j < k since GxN C K/N However, we cannot have j = k unless N = K, 
which we have assumed is not the case, since K/N must contain at least two classes (one 
identity and one non-identity). Hence, we can conclude that = |Ga;Ar| is smaller than 
= \K/N\ by at least a factor of p > 2. We conclude as before that the probability 
of measuring the trivial irrep is at most 1/2. □ 

^®This result holds for black-box groups, so we only need to assume that we know the kernel of each 
irrep not that we can intersect the kernels of arbitrary irreps. 
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Theorem 9 (CC-HSHP Is Easy, III). Let G be a nilpotent group. Suppose that we 
are given a hiding function /:G—>-{0,1}*. If we can efficiently compute the QFT for 
G and we can efficiently compute the kernels of irreps when restricted to subgroups, then 
there is an efficient quantum algorithm for the CC-HSHP. 

Proof. A nilpotent group is a direct product of p-groups for different primes [98]. This 
means that any subgroup must be a direct product of subgroups, one in each of the p- 
groups.^® Hence, it suffices to solve the CC-HNSP in each of these p-groups. □ 

Finally, we can apply this result to the HSNP if we are given an oracle that can be 
converted into a CC-HSHP oracle. 

Corollary 4 (HNSP is easy, III). Let G be a nilpotent group. Suppose that we are 
given a hiding function / : G —)■ H that is a homomorphism. If we can efficiently implement 
the QFT for G, compute with conjugacy classes of G and H, and compute kernels of irreps 
when restricted to subgroups, then there is an efficient quantum algorithm for the HNSP. 

We note that the class of nilpotent groups includes the Heisenberg group, which, as we 
saw in Example 1, is a case where the original AKR algorithm does not find the hidden 
normal subgroup with polynomially many samples. Our last algorithm, however, solves 
the problem efficiently in this case. 

Our assumption in the results above that we can efficiently compute the kernel of any 
irrep of G when restricted to a normal subgroup may seem weaker than the assumption 
of HRT that we can intersect the kernels of irreps (which HRT does in order to find N). 
However, it is not hard to see that the two assumptions are in fact equivalent. Certainly, 
if we can intersect kernels of irreps, then we can use that to hnd since the latter 

equals ker uCiK and K itself is the intersection of kernels of irreps (by induction). Likewise, 
if we are given a list of irreps, one way to compute the intersection of their kernels is to 
order them and then repeatedly compute the kernel of the next irrep restricted to the 
intersection of the kernels of those previous. 

Hence, both HRT and our last algorithm require the same assumptions in order for 
the classical parts of the algorithms to be efficient. Nonetheless, the quantum parts of the 
two algorithms are fundamentally different, so our algorithm demonstrates a new way in 
which this important problem can be solved efficiently by quantum computers. 

7.4 Further results and open problems 

We finish this section with some discussion on whether this last result can be extended 
further. The most natural next step beyond nilpotent groups would be to show that 
the algorithm works for super-solvable groups. We start with a positive example in that 
direction. 


Example 2 (Dihedral Groups). As we saw above, the algorithm will work correctly 
provided that the probability of measuring the trivial irrep is not too close to 1. By 
equation (38), this is given by 

Without loss of generality, we may assume = {e} by instead looking at the group 
G/N. For a dihedral group, such a quotient is either dihedral or abelian. Since abelian 


^®This is, for example, an immediate consequence of Goursat’s Lemma [99] (since a quotient of ap-group 
and a quotient of a g-group, with q p, can only be isomorphic if they are both trivial groups). 
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groups are (trivially) nilpotent, we know the algorithm works in that case already. 

By our earlier arguments, the probability bounded by a constant 

below one provided that the fractional weights Wc/wk are bounded by a constant below 
one. In other words, our only worry is that there is a normal subgroup K containing a 
conjugacy class that is nearly as large as K. 

Let us consider the dihedral group of order 2n, generated by a rotation a of order n and 
a reflection r of over 2. Most of the normal subgroups are contained in the cyclic subgroup 
(a). These are subgroups of the form {a^) with d dividing n. Every conjugacy class in this 
subgroup contains either 1 or 2 elements (since r~^a^r = a~^ and hence r~^a~^r = a^). 
Since a nontrivial normal subgroup cannot consist of one conjugacy class, the worst case 
would be when K has 3 elements and contains a conjugacy class with 2 elements. In that 
case, the probability of measuring the trivial irrep could only be as large as 2/3, which 
still a constant (independent of n) less than one“. 

If n is odd, then any normal subgroup K containing r is the whole group, and the 
largest conjugacy class contains every a^r for j G Z,i, which is half the elements, so we get 
a bound of 1/2 in that case. If n is even, then there are two more normal subgroups, one 
containing for each j and one containing but both also contain all rotations 

of the form , so at least half of the elements in these subgroups are contained in 1-2 
element conjugacy classes, and once again we get a bound of 1/2. 

All together, this shows that the probability of measuring the trivial irrep is at most 
2/3 for the dihedral groups, so the algorithm will succeed with high probability. 


“Note that if < c, then character orthogonality (8) lets us bound the probability 

of measuring a character € T* (38) since Pt{X^)/wxi^ = r\x,{c^r < 

Specifically, for any invertible character we get Pr(A’^) < c. 

On the other hand, we also have a negative example. 


Example 3 (Super-solvable group [97]). We will consider the group of simple affine 
transformations over Zp. These are transformations of the form x ^ ax + b for some 
a G Zp and b G Zp, which we denote by (a, b). These form a group under composition. In 
particular, applying (a, b) and then (c, d) gives acx + bc+d, which shows that (c, d) ■ (a, b) = 
(ac, bc + d). A simple calculation shows the formula for the commutator 

[(a, b), (c, d)] = (1, c“^(l — a~^)d — a“^(l — c~^)b). 

This implies that the commutator subgroup [G, G] is contained in the set {(1, 6) | 6 G Zp}. 
On the other hand, taking a = 1, c = 2“^, and d = 0 in this formula gives the result (1, 6), 
so [G, G] must contain all the elements of this set. If we mod out [G, G], then we are left 
with the abelian group Z^ . We have proven that the group is super-solvable. 

On the other hand, for any element (l,d), taking a = 2~^,c = 1 and 6 = 0 in the 
formula above gives the result (1,—d), which is not the identity (1,0). This means that 
the group has a trivial center, and thus, it cannot be nilpotent. 

Another simple calculation shows that conjugating (1,6) by (c, 0) gives us (l,c“^6). 
Hence, the conjugacy class of (1,6) with b ^ 0 contains every (1,6') with 6' ^ 0. This 
is all of the subgroup [G, G] except for the identity element (1,0). Hence, once we have 
K = [G,G], we can see by equation (38) with N = {ej that the algorithm will get the 
trivial irrep with high probability, so we can see that the algorithm will fail to find N in 
this case. 
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Put together, these results show that our last algorithm works for some non-nilpotent, 
super-solvable groups (like the dihedral groups^*^), but not all super-solvable groups since 
it fails on the affine linear group. Determining exactly which super-solvable groups the 
algorithm does succeed on is an open problem. 
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A Proof of theorem 3, part II 

In this appendix, we derive equations (23-26) finishing the proof of theorem 3. We treat 
the different types of normalizer gates separately below. 

1. Automorphism Gates. It follows from the definition in section 2 that any hy¬ 
pergroup automorphism a fulfills 6 Wa(a) = Wa for all a,b,c £ T. 

Combining these properties with (18) we derive (24). 

2. Quadratic phase gates. The RHS of (25) follows because is diagonal, hence, 
commutes with Zy-{AI^). 

The LHS can be derived by explicitly evaluating the action of D^Xr{a)D'^^ on basis 
states in B 7 - = {16), 6 G T} using that, for any c, d £ ab and any quadratic function 
^ with associated bicharacter B, the following identities holds: 


(i) C{c) = (.{c') = f,{ab), (ii) ^(c) = C(o)^( 6 )R(a, 6 ), (hi) B{a,b) = Xp(^a){b) 


for some homomorphism /3 from T onto 7)*^. Above, (i) follows from the triangle 
inequality and given properties, namely, f,{ab) = Yhc&ab'Kib^i^)-: 

(ii) follows from (i) and the definition of quadratic function; and last, the 
normal form for bicharacters (iii) can be obtained by extrapolating the group-setting 
argument given in [40], lemma 5. 

3. Quantum Fourier transforms. We derive (26) by explicitly computing the action 
of Pauli operators on the states F^\X^) (which form a basis) using (10): 


Xr{a)T\-\X,) = Y,\I 


Wi,W^ 


X^{b)Xr{a)\b) 


(39) 



X^{a)X^{c)\c) 


A^(a)T-|lA^) =T|Zr.(a)lA^) 


(40) 
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Zr{X^,)T\-\X,) 

her 


X^{b)X,{h)\b) 

ZUf 
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6er 
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WjW^ 

'UJ'Y 


Y1 1^) 


yX^&T* 


_r^ \/ Wx- 

V CT-* V ^ 
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- ml,v 


\b&T 




— Trt 


4 E 


Wj' 
— Trt 


'^"■'ml^\X^)=XJ^Xr*iX^)\X,), 


Wx, 


(41) 


(42) 


where we used Wx^ = u>;tT, and rnX = rrCL^ from section 2. The analogous statement 
for partial QFTs follows straightforwardly using that character hypergroup of 71 x 
• • • X Tm is Ti X • • • X 7^ [82] and the tensor-product structure of Pauli operators 
(section 5.1). 

4. Pauli gates. We can use (26) to get Z'Y{Xc;)Xr{a)Z'Y{Xc;)^ = X^{a)Xr{a) and 
Zr{X,)ZrWZr{X,)^ = Zr{X^) since invertible characters are quadratic functions 
with trivial B and /3. Moreover, we can apply (26) and repeat the argument in 
the character basis, obtaining X'j-{s)XT-{a)X'j-{s)^ = Xj-(a), X'j-(s)ZT-(Xfj,)X-j-(s)^ = 
Xf^(s}Z-j-(Xfj^). Equation (23) is derived combining these expressions. 


B Quadratic functions 

We prove that the functions ^j, and ^ defined in section 4.2 are quadratic. The 
quadraticity of ^x, with x = i,j,k, follows from the fact that the function can be ob¬ 
tained by composing the quotient map Qg —)• Qg/{X.l,Xx} = 1 ^ 2 -, with the isomorphism 
Qs,/ (®) ^2 and the map Z 2 —)• C : a —)■ i“; since the latter is a quadratic function of Z 2 
[40], it follows easily that is a quadratic function of Qg. Note that in this derivation we 
implicitly use that {±l,±a:} is a subhypergroup of Qg [73], that the quotient Qg/S is an 
abelian hypergroup for any subhypergroup 5, and that the quotient map Qg —)• Qg/5 is a 
hypergroup homomorphism [73]. 

To show that ^ : Qg x Qg —)■ C is quadratic, we use the fact, prove below, that the 
function B{Cx,Cy) := fcxi^y) is a symmetric bi-character of Qg. Given that property as 
a promise and recalling that C{{Cx, Cy)) = B{Cx, Cy) (by definition), we can see that 

^ {{Ca, CQ ■ (Ce, Cd)) = B{CaC„ CfeCrf) = B{Ca, CbCd)B{Cc, CbCd)) 

= B{Ca, Cb)B{Ca, Cd)B{Cc, Cb)B{Cc, Cd) 

= ^ {{Ca, CQ) c ((C„ Cd)) B{Ca, Cd)B{Cc, Cb) 

= e {{Ca, Cb)) ^ ((Ce, Cd)) B' {{Ca, GQ, (C^, Cd)) , (43) 

where we define B' {{Ca, Cb), {Cc, Cd)) = B{Ca, Cd)B{Cc, Cb)- The latter is easily seen to 
be a bi-character of Qg x Qg, so that ^ is indeed quadratic. 

It remains to show that B[Cx,Cy) is a symmetric bi-character. To see this, note, 
that both the quotient hypergroup Qg/{±1} and the subhypergroup of linear characters 
Qg^ of Qg are isomorphic to the Klein four group Z 2 x Z 2 . Observe next that the map 
Cx fcx is ^ homomorphism Qg —)• Qg^, as it can be obtained composing the quotient 
map Qg —7- Qg/{±1} with a chain of isomorphisms Qg/{±1} —?• Z 2 x Z 2 —)• Qg^. This 
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latter fact implies that B{Cx,Cy) = fc^iCy) is a character in both arguments, hence, 
a bi-character. Finally, it is routine to check that B{Cx,Cy) = B{Cy,Cx) by explicit 
evaluation, which completes the proof. 

C Efficient vs. doubly efficient computable hypergroups 

We give an example of an efficient computable abelian hypergroup that cannot be doubly 
efficiently computable unless we are given the ability to compute discrete logarithms over 
Zp , a problem that is believed to be hard for classical computers and is the basis of 
the Diffie-Hellman public-key cryptosystem [100]. (Quantum computers can solve this 
problem using Shor’s discrete-log algorithm [1]. This problem reduces to the so-called 
hidden subgroup problem over Zp_]^ [101] for a certain hiding function /, which defines a 
group homomorphism from Zp_^ to Z^ [36].) 

Considering now the group T = '^p-i x Z^ , which is manifestly efficiently computable 
following our definition, we can define an efficiently computable group automorphism a : 
T ^ T : {m,x) —)• (m, f{m)x). We show that T cannot be doubly efficiently computable 
unless the initial hidden subgroup problem and, hence, the discrete logarithm problem, 
can be solved in probabilistic polynomial time (which, up to date, is not possible). 

First, we show that, if we are able to compute^^ a*, we must also be able to compute 
f*:Xp^ 1‘p_i (the dual of /, which is defined analogously to a*), since for any ;= 
Xy ® Xy we have 


^a*{fj,,u){m,x) = {Xy (g) X^){m, f{m)x) = Xy{m)X^{f{m))X„{x) = Xy{m)Xf*(^^){m)Xy{x), 

consequently, Xa*(y^u) = ® ^u- Hence, if we can evaluate a* on any character 

Xi®Xy, then we can determine the value of f* on i^, for any Xy. If we now evaluate 

on all elements of a 0(logp)-sized randomly-obtained generating set {Xy.} of Z^ 
and use existing classical algorithms [41] to solve the system of equations {[f*{lJ-i)]ix) = 
Xy.{f{x)) = l,x G Zp_^}, whose solutions are those x for which f{x) = e, we have found 
(in these x’s) generators of the hidden subgroup. This finishes the reduction. 

D Implementing normalizer circuits over G 

In this section, we present more details on how to efficiently implement normalizer circuits 
over the hypergroup G when we are working in the Hilbert space Bg = {\g) \ g £ G} labeled 
by elements of the group. As described in section 4.2, normalizer circuits over G can be 
thought of as operating entirely within the subspace Iq < of conjugation invariant 
wavefunctions; however, we will describe these operations in this section in terms of how 
they operate on the entire Hilbert space. In section D.l, we discuss operations applied in 
the character basis, and in section D.2, we discuss the same in the conjugacy class basis. 

D.l Working in the character basis 

Normalizer circuits allow of the following operations to be performed in the character 
class basis: preparation of initial states; Pauli, automorphism, and quadratic phase gates; 
and measurement of final states. It should be easy to understand how each of these 
could be implemented efficiently if we worked in a basis {]//) j g G Irr(G)} of irrep labels. 

“^^We are implicitly assuming that there are efficient unique classical encodings for representing the 
characters of Zp , which is a strong yet weaker assumption that Zp being doubly efficiently computable. 
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However, the Hilbert space T-Lq is only naturally labeled by group elements, which is why, 
in section 4.2, we defined the character basis states | Xfi G G} in the element basis. 

Below, we will describe how to implement an isometry \Xfj,) |//) and its inverse, 
using a readily available choice for the basis {|//) | /i G Irr(G)}. It should then be clear 
that we can implement each of the above gates by applying r, performing the operation in 
the irrep label basis, and then applying To prepare an initial state we prepare 
l/i) in the irrep label basis and then apply Finally, to measure in the character basis, 
we apply r and then read the irrep label. 

Our definition of the irrep label basis {{fi) \ fi € Irr(G)} comes from the definition of the 
QFT over the group G. Recall that the QFT over any finite group G [89], denoted 7 'g'j is 
a unitary gate that sends an element state \g), for any g G G, to a weighted superposition 
|^|-i /2 ij,{g)), where \fi) is a state that labels the irrep g and \g{g)) is a 

dimensional state defined via 


lh(5)) 


{g{g) ® Id^) 

i=l 


\hi) 


E 


*j=i 




ij)- 


(44) 


This transformation J^g has been extensively studied in the HSP literature and efficient 
quantum implementations over many groups are currently known (including the symmetric 
group, wreath products of polynomial-sized groups and metabelian groups [89]). 

To see how we can use this, let’s look at what does to a character class state. In 
(14), we defined the state \Gx)-, when living inside the Hilbert space Tic, to be a uniform 
superposition over the elements in the class Gx- If we apply Tq to this state, the result is 


^g\Gx) = Y ^g\9) 

= ^Evk E 




i,j) 


Atelrr(G) 




Y dY)®Y ——EP—Ibj)- 


Aielrr(G) 


*J=1 




To simplify further, we need to better understand the sum in the numerator on the right. 

The sum 1^(9) more easily analyzed if we write it as (ICajl/IGI) Ylh&G 

by standard results on orbits of group actions [99], each g{g), for g G Cx, arises the same 
number of times in the sum Ylh&G which hence must be IGl/ICxI times for each, 

so we have (|C'^|/|G'|) E/xsG = '>2g&c^9{9)- The sum {1/\G\)Y&g ™ay be 

familiar, as it is well known to be [102].^^ 

Putting these parts together, we can see that 


J^g\Cx) 


1 


Y dg\g)^Y 

Atelrr(G) i=l 


\Gx\Xg{x) ^, 

dfi\J dfj^ 




^^This is a simple application of Schur’s lemma. This sum is a G-invariant map Hg 'Ha, so it must 
be a constant times the identity. The constant is easily found by taking the trace of the sum. 
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which is rewritten in our usual hypergroup notation as 


This precisely mirrors the definition of Fq with \X^j) replaced by 

will denote the latter state below by l/^diag)- Thus, it follows by (7) that ~ IWiag)- 

To implement the operation r, we apply Fq and then carefully discard the matrix 
index registers.By the above discussion, we can see that this maps to the state 
l/i), so this implements the operation r correctly for any conjugation invariant state. 

To implement the operation we do the above in reverse. Starting with a state 
l/i), we adjoin matrix index registers, prepare a uniform superposition over |1),..., |d^) 
in the first index register using the inverse Fourier transform over the abelian group , 
and then copy the first index register to the second^^ to get the state |//diag)- Finally, we 
apply Fq to get the state \Xf^) per the calculations above. 

As discussed earlier, the operations r and are all that we need in order to implement 
each of the required operations of normalizer circuits over G in the character basis. 

D.2 Working in the character class basis 

Most of the time, gates applied in the conjugacy class basis arise from operations on the 
whole group. For example, automorphisms of conjugacy classes often arise from auto¬ 
morphisms of the group. Likewise, Pauli Z operators in the conjugacy class basis are 
applications of characters, which are defined on the whole group, and Pauli X operators 
can also be implemented using multiplication in the group. Hence, it remains only discuss 
how to prepare initial states and measure in the conjugacy class basis. 

For this, we need to assume that we can perform certain operations on conjugacy 
classes, as described in the following definition. 

Definition 4. Let Ci,... ,Cm be the conjugacy classes of G. Consider the following 
operations for working with conjugacy classes: 

• Given a conjugacy class label i, produce the size of this class, \Gi\. 

• Given an x G G, produce the pair (i, j), where x = Xj in the class Gi = {xi,..., xt}. 

• Given a pair produce the element Xj from C*. 

If each of these operations can be performed efficiently, then we say that we can compute 
efficiently with conjugacy classes of G. 

We note that this assumption is trivial for abelian groups since each element is in 
its own conjugacy class. For some common examples of nonabelian groups, such as the 
dihedral and Heisenberg groups (and their higher nilpotent generalizations), elements are 
normally encoded in this manner already, so no additional assumption is actually required. 

full detail, we do the following. First, apply the map \i,j) which gives |i,0) when 

applied to \i, i). Next, write down in a new register and then invoke the Fonrier transform over on 
the first index register. The result of this will always be |0), so after uncomputing d^, we are left with the 
state |0,0) in the index registers regardless of the value of fi. At that point, they are unentangled and can 
be safely discarded. 

"^^Or rather, apply the map \i,j) \i,i + j), which gives \i,i) when applied to |i,0). 



= E 




MCx) 


— T 

i=i 
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For other common examples like the symmetric group, while elements are not always 
encoded directly in this manner, it is easy to see how the above calculations can be 
performed efficiently. In general, while we must formally make this assumption, we are 
not aware of any group for which these calculations cannot be performed efficiently. 

If we can compute efficiently with conjugacy classes of G, then we can prepare initial 
states as follows. Starting with the conjugacy class label i in a register, we first compute 
the size \Ci\ into a new register. Next, we adjoin another new register and invoke the 
inverse Fourier transform over the abelian group '^\Ci\- After uncomputing the size \Ci\, 
we are left with the superposition Ii, j), where M = \Ci\. Finally, we apply the 

operation that turns pairs into group elements to get ''^here xi,..., xm 

are the elements of Ci, which is the desired initial state. 

To perform a measurement in the conjugacy class basis, we can do the reverse of how 
we prepared the initial states in order to produce a conjugacy class label |i) in a register. 
Alternatively, we can simply measure in the group element basis and then, afterward, 
compute the conjugacy class of this element. These two approaches will give identical 
measurement probabilities. 

Finally, we note that the two operations just described are the equivalent of the opera¬ 
tions r and from section D.l for the conjugacy class basis.As a result, if we do have 
gates that can be easily implemented on conjugacy classes but do not extend easily to the 
whole group, then we can implement these gates in the same manner as in the character 
basis: apply r to convert into a basis of conjugacy class labels {|i) | Cj G G}, apply the 
gate in this basis, and then apply move back to the conjugacy class basis in 'Hg- 

Thus, we can see that the ability to compute efficiently with conjugacy classes of G 
allows us to fully implement normalizer circuits operations applied in the conjugacy class 
basis. If we also have an efficient QFT for G, then as we saw in the previous section, 
we can implement normalizer circuits operations applied in the character basis as well. 
Together, these two assumptions allow us to fully implement normalizer circuits over G 
when working in the Hilbert space Hg- 


^®Indeed, the separation of a group element label into a conjugacy class label and an index label is 
analogous to how, in the space of irreducible representations, we separate each basis element into an irrep 
label and matrix index labels. It is frequently assumed that we can separate the latter into different 
registers whenever convenient, so our assumption that we can do the same for conjugacy classes is only 
affording the same convenience for the hypergroup G that is often assumed for G. 


53 



